I wired a paper-trading bot to the Toss Securities Open API. Here are a few gotchas the docs don't flag — same purpose as my launchd and ffmpeg gotcha notes.
Exchange rate uses baseCurrency / quoteCurrency
The exchange-rate endpoint doesn't take the usual from/to or pair — it takes baseCurrency/quoteCurrency. Get the names wrong and you get a quietly empty response, not an error. So you chase a "the rate comes in as 0" symptom for a while — when really the param name was wrong.
There's no sandbox
No mock/sandbox environment. You connect with live credentials, so you have to keep it safe with read + paper logic that places no orders. "Test in the sandbox first" isn't possible, so I force dry-run in code — the live-order path is blocked by default and only opens behind an explicit flag.
Candle history does exist
The candles endpoint has history, so you can pull backtest data straight from the API. That's one place I didn't need a separate data source — the docs were pleasantly wrong (it gives more than expected).
Credential storage
Kept in ~/.config/toss/credentials.env, never committed to the repo. A live brokerage API means the leak risk is real money, so even at the paper stage I lock down file permissions and .gitignore from the start.
Small things that don't stand out in the docs — writing them down so the next wiring doesn't stall in the same spots.