What causes "Missing API credentials; set Deribit environment variables" in nautechsystems/nautilus_trader?

Set the Deribit API credential environment variables (client id and client secret) before connect, e.g. export DERIBIT_CLIENT_ID=... and DERIBIT_CLIENT_SECRET=...

nautechsystems/nautilus_trader · critical

Missing API credentials; set Deribit environment variables

Error message

Missing API credentials; set Deribit environment variables

What it means

After establishing the WebSocket connection, the Deribit execution client checks config.has_api_credentials() before requesting account state. If no API credentials are configured, it bails, because trading operations require authenticated access to Deribit's private API.

Source

Thrown at crates/adapters/deribit/src/execution.rs:508

            self.await_session_tasks().await?;
            self.session_tasks
                .start_generation()
                .map_err(|e| anyhow::anyhow!("Failed to start Deribit session generation: {e}"))?;
        } else if self.ws_client.is_active() {
            self.ws_client
                .close()
                .await
                .context("failed to close stale Deribit WebSocket")?;
        }
        let ws_client = self.ws_client.clone();
        let setup_guard =
            TaskGroupGuard::new(&[&self.session_tasks, &self.pending_tasks], move || {
                ws_client.begin_shutdown();
            });

        // Check if credentials are available before requesting account state
        if !self.config.has_api_credentials() {
            anyhow::bail!("Missing API credentials; set Deribit environment variables");
        }

        // Set account ID for order/fill reports
        self.ws_client.set_account_id(self.core.account_id);

        // Fetch and cache instruments in both HTTP client and WebSocket client
        if !self.core.instruments_initialized() {
            for product_type in &self.config.product_types {
                let instruments = self
                    .http_client
                    .request_instruments(DeribitCurrency::ANY, Some(*product_type))
                    .await
                    .with_context(|| {
                        format!("failed to request instruments for {product_type:?}")
                    })?;

                if instruments.is_empty() {
                    log::warn!("No instruments returned for {product_type:?}");

View on GitHub (pinned to 18893faf8b)

Solutions

Set the Deribit API credential environment variables (client id and client secret) before connect, e.g. export DERIBIT_CLIENT_ID=... and DERIBIT_CLIENT_SECRET=...
If credentials are passed via config, ensure DeribitExecClientConfig includes them (or the env vars it reads)
Verify the credentials match the selected environment (test vs live) and are valid on Deribit
Confirm the process env actually contains the vars (print/debug or shell `env | grep DERIBIT`) — .env files often aren't auto-loaded

Example fix

// before: connecting with no credentials in env
exec_client.connect().await?;
// after: ensure credentials are present first
std::env::set_var("DERIBIT_CLIENT_ID", client_id);
std::env::set_var("DERIBIT_CLIENT_SECRET", client_secret);
exec_client.connect().await?;

Defensive patterns

Strategy: validation

Validate before calling

fn has_deribit_creds() -> bool {
    std::env::var("DERIBIT_CLIENT_ID").is_ok() && std::env::var("DERIBIT_CLIENT_SECRET").is_ok()
}
if !has_deribit_creds() { return Err(anyhow::anyhow!("export DERIBIT_CLIENT_ID / DERIBIT_CLIENT_SECRET first")); }

Try / catch

match exec_client.connect().await {
    Err(e) if e.to_string().contains("Missing API credentials") => {
        load_env_file();
        exec_client.connect().await
    }
    other => other,
}

Prevention

Export DERIBIT API env vars in shell profiles, CI secrets, and container env before startup
Explicitly load .env files; they are not read automatically by the process
Match credentials to the configured environment (testnet vs live)
Check has_api_credentials() on the config before attempting connect

When it happens

Trigger: Calling connect() on the Deribit execution client when no API key/secret environment variables (Deribit client id/secret) are set in the environment or provided in the config.

Common situations: Running in an environment where DERIBIT_* env vars were never exported (CI, containers, new machine); pointing at live env but credentials only configured for testnet (or vice versa); typo'd env var names; .env file not loaded.

Related errors

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/ea4da5fe76b89dc9. Report an issue: GitHub.