1. Deribit Support
  2. Support
  3. Technical Information

Deribit AWS Endpoint Service instruction

  • Updated

In order to offer its customers residing in AWS a direct connection to its backend systems, Deribit has created an AWS Endpoint Service for customers to directly connect to. The solution is based on AWS PrivateLink, a managed service built for service provider/service consumer connectivity models. This instruction describes how customers can connect to the Deribit Endpoint Service from their AWS environment. The Service is available within several AWS regions. 

As with any service provider/service consumer model, AWS PrivateLink will only allow connectivity to be initiated from your VPC to the Deribit VPC, never in the other direction, so you have complete control over which network traffic will be able to go through the VPC Endpoint. The Deribit Endpoint Service is accessible via 3 groups of ports, to be able to reach 3 different gateways:

  • HFT gateway 1: 443, 8020, 8021, 8022 and 8025

  • HFT gateway 2: 2443, 28020, 28021, 28022, 28025

  • HFT gateway 3: 3443, 38020, 38021, 38022, 38025

You can only have a session open to one HFT node at the same time. Logging into a new HFT gateway will disconnect any session(s) you have open on other HFT gateways. You are free to choose which HFT gateway you prefer to use and you can switch between these at any time. There is a minimum connection duration of one second before you can switch to a different HFT gateway.

Consult Deribit for the port number that’s best for you or scroll below for more information.

1. Create VPC Endpoint

In order to connect to the Deribit service, you first have to create a VPC Endpoint which will be connected through PrivateLink to the Deribit VPC Endpoint Service. In order to create this VPC Endpoint log in to the AWS Console, go to the AWS Account in which to create the VPC Endpoint, choose the appropriate AWS region and go to the VPC from which you want to access the Deribit service. From the menu choose ‘Endpoints’, ‘Create Endpoint’. Select ‘PrivateLink Ready partner services’: 

In order to connect to the Deribit service, you first have to create a VPC Endpoint which will be connected through Priv

Fill in the name belonging to your specific region and click ‘Verify Service’:

Table 1. Deribit services for AWS regions

AWS region

Deribit service name

eu-west-2 (London)

com.amazonaws.vpce.eu-west-2.vpce-svc-040cd502947f69842

ap-northeast-1 (Tokyo)

com.amazonaws.vpce.ap-northeast-1.vpce-svc-04de4df0469ee98af

The following status should appear indicating that the Deribit service was successfully located:

The following status should appear indicating that the Deribit service was successfully located:

In order to connect to the Endpoint using custom private DNS (explained further), make sure default private DNS is not enabled under Additional settings: 

In order to connect to the Endpoint using custom private DNS (explained further), make sure default private DNS is not e

Now select the VPC in which the VPC Endpoint should be created, followed by the Availability Zones in which to enable the VPC Endpoint. For redundancy/high availability purposes, Deribit has made its service available in two Availability Zones per region:

Table 2. Availability Zones for AWS regions

AWS region

Availability Zones

eu-west-2 (London)

euw-az2 & euw-az3

ap-northeast-1 (Tokyo)

apne1-az1 & apne1-az4

We recommend creating the VPC Endpoint in both AZ’s and recommend your application is also available in both AZ’s. 

Create and attach a Security Group to the VPC Endpoint for security purposes, and add Tags according to your company policies. If you do not define a Security Group, the Default Security Group will be associated: 

Create and attach a Security Group to the VPC Endpoint for security purposes, and add Tags according to your company pol

Make sure the associated Security Group has Inbound Rules allowing traffic from your VPC to access the Endpoint. To edit go to the ‘Inbound Rules’ tab, click ‘Edit Inbound Rules’. Click ‘Add rule’ and define which traffic is allowed to access the Deribit backend. For example in this case my entire VPC with CIDR range 10.0.0.0/16 over destination port 8020: 

Make sure the associated Security Group has Inbound Rules allowing traffic from your VPC to access the Endpoint. To edit

Click ‘Save rules’. Click ‘Create Endpoint’ to finalize. 

2. Connection Acceptance

The connection request that was created in Step 1, has to be accepted in the Deribit AWS account, until that happens the VPC Endpoint in your account will remain in the ‘pending acceptance’ state:

The connection request that was created in Step 1, has to be accepted in the Deribit AWS account, until that happens the

In order to inform Deribit you have created a connection request, please send an email to ‘colo-support@coinbase.com’ from the email registered with the full Deribit UID following the below guidelines:

  • Include the following in the mail subject:

    • #acceptance request - <your company name> - <UID>

  • Include the following in the email body:

    • The VPC Endpoint-ID you just created (‘vpce-xxx’)...

    • The AWS region in which you made the connection acceptance request.

    • Your Deribit UID (a full Deribit account UID and not a test account)

Deribit will then accept the connection request, inform you by email and after a few minutes the status of the VPC Endpoint will change to ‘available’. It is now ready for use:

Deribit will then accept the connection request, inform you by email and after a few minutes the status of the VPC Endpo

3. Route network traffic to VPC Endpoint

The next step is to enable services within your VPC, like for example EC2 instances or Lambdas, to access the VPC Endpoint. We recommend the use of a Private Hosted Zone in the Route53 AWS DNS service. If you will be accessing the Deribit service over TCP port 443 your DNS record needs to be ‘gateway’ in the ‘deribit.com’ hosted zone, in order for the SSL certificate to match ‘gateway.deribit.com’. If you are using any of the other TCP ports (8020, 8021, 8022, 8025, 28020, 28021, 28022, 28025, 38020, 38021, 38022 or 38025), there is no SSL certificate so you can choose your own record and zone.

Go to Route53 in the AWS Console, create a Private Hosted Zone if you don’t have one already, otherwise use one you were already using. For this example we will use the zone ‘deribit.int’ (‘deribit.com’ if you are using TCP 443, 2443 or 3443).

Within that hosted zone choose ‘Create record’, select the ‘Simple Routing’ policy:

Within that hosted zone choose ‘Create record’, select the ‘Simple Routing’ policy:

Click Next and choose ‘Define simple record’. Fill in the record details:

  • Record name – choose your own record, in this example we will use ‘test’ (‘gateway’ if you are using TCP 443, 2443 or 3443);

  • Record type – A ‘Routes traffic to an IPv4 address and some AWS resources’;

  • Value/route traffic to – choose ‘Alias to VPC Endpoint’;

  • Region – choose the region in which you created the Endpoint’;

  • Choose endpoint – select the Endpoint created in Step 1. Note to choose the one with the region (for example ‘eu-west-2’ or ‘ap-northeast-1’), not the one ending with ‘a/b’.

Choose endpoint – select the Endpoint created in Step 1. Note to choose the one with the region (for example ‘eu-west-2’

Select ‘Define simple record’ and ‘Create records’. It is being created and will take a few minutes to become available.

4. Test the connection

From your EC2 instance or Lambda service test the connection with for example telnet, using the created private DNS record in Step 3 followed by one of the TCP ports (In our example: ‘telnet test.deribit.int 8020’). The test should result in an active connection, it is now available for your regular requests for the Deribit backend.

Starbase Gateway Ports

The following ports are available at LD4 for connecting to Starbase gateways via the AWS Endpoint Service. For the underlying gateway addresses, see Gateway Connectivity.

Note

Starbase production connectivity via the AWS Endpoint Service goes live on 21 July 2026. The production ports below will be added during scheduled maintenance between 09:00 and 09:30 UTC on that date.

Table 3. Starbase gateway ports at LD4 (production)

Gateway

Side

Port

Protocol

AWS port (LD4)

sbe-order (BTC)

A

4210

TCP

34210

sbe-order (ETH)

A

4211

TCP

34211

sbe-order (Tier 2)

A

4212

TCP

34212

sbe-order (Tier 3)

A

4213

TCP

34213

sbe-order (BTC)

B

4210

TCP

44210

sbe-order (ETH)

B

4211

TCP

44211

sbe-order (Tier 2)

B

4212

TCP

44212

sbe-order (Tier 3)

B

4213

TCP

44213

rest-order

A

4410

TCP

34410

rest-order

B

4410

TCP

44410

fix-dropcopy

A

4130

TCP

34130

fix-dropcopy

B

4130

TCP

44130

Table 4. Starbase gateway ports at LD4 (test environment)

Starbase gateway type

Protocol

AWS port (LD4)

sbe-orderA

TCP

14210

sbe-orderB

TCP

24210

rest-orderA

TCP

14410

rest-orderB

TCP

24410

fix-dropcopyA

TCP

14130

Troubleshooting

Why am I getting a response error 404 ?

Verify the following:

  1. Your VPCE is in the correct zone, either London or Tokyo, depending on which region you’ve requested.

  2. Confirm that step number 3 in the setup guide is correctly configured, and that the DNS point to gateway.deribit.com

IP whitelisting - I wish to whitelist my IP

IP whitelisting can be managed via the API directly, without any intervention from Deribit. If you wish to confirm your IP address, simply send a request and then email with your UID and the exact time window so we can trace it back from the logs for you.

What is the difference between each port ?

  • 8020/28020/38020 (HTTP): Used for standard web traffic.

  • 8021/28021/38021 (API): Designated for API (Application Programming Interface) communication.

  • 8022/28022/38022 (WS): Used for WebSocket connections.

  • 8025/28025/38025 (FIX): Dedicated to the FIX (Financial Information eXchange) protocol, primarily for orders.