Skip to main content
Kalshi provides separate production and demo environments. Credentials are not shared between environments, so demo API keys only work against demo endpoints and production API keys only work against production endpoints.

​
REST API

Use these base URLs for the Trade API: The external-api hosts are dedicated to the external Trade API and are the recommended hosts for API traders. The existing shared hosts remain supported for compatibility with existing clients.
Despite the elections subdomain, the production Trade API provides access to all Kalshi markets, not only election-related markets.

​
WebSocket API

Use these WebSocket URLs for the Trade API:

​
External Feeds WebSocket

External feeds are moving to dedicated hostnames. Existing feed URLs remain supported during the migration.
The dedicated feed endpoints are: Update your feed client’s connection URL when the new endpoint is available. Continue signing GET /trade-api/v2/external-feeds with the existing API-key authentication. The path, channel entitlements, subscription messages, and payloads do not change. The Trade API REST and standard WebSocket URLs above are unaffected by this feed hostname change. Server-to-server clients may omit Origin. Both the old and new feed Origins are accepted during the migration window. If your client explicitly sets Origin to the old feed hostname, update it along with your connection URL to https://external-feeds.kalshi.com in production or https://external-feeds.demo.kalshi.co in demo. This change does not require browser clients to override their browser-managed Origin header.

​
Private Connectivity

For participants requiring network-level isolation, Kalshi supports private connectivity to the REST and WebSocket APIs via AWS PrivateLink. With PrivateLink, your API traffic is routed entirely within the AWS backbone and never traverses the public internet. PrivateLink is available for the production hosts external-api.kalshi.com (REST) and external-api-ws.kalshi.com (WebSocket). The two APIs are provisioned as separate interface endpoints, each reachable over TLS on port 443. Connect to the endpoint’s DNS name from within your VPC and set the matching host above as the TLS server name (SNI). Members on the Premier tier or above can contact institutional@kalshi.com to provision PrivateLink endpoints for their AWS account. Members on the Prime tier or above can also contact institutional@kalshi.com to discuss VPC peering for production WebSocket connectivity from their AWS VPC.

​
Request Signing

The host does not change the signature payload. Sign the full request path from the API root, without query parameters. For example, all of these hosts use the same signed path for an order request:
If the request URL is:
sign:
not the hostname and not the query string.