Exchange API Keys and Security: Read, Trade, No Withdrawals and IP Allowlists

Connecting a trading bot begins with issuing an exchange API key. A single permission mistake, however, can expose the entire balance. Here are the basics of keys, permissions, IP allowlists and practical security.

What is an exchange API key?

An API key is an access credential that lets a program use an exchange account without an interactive login. It usually includes two strings.

• API Key — An identifier showing who is making the request.
• Secret Key — A password-like value used to sign requests. It is generally displayed only once when issued and cannot be displayed again by the exchange.

Some exchanges also require a passphrase. The key point is that API access operates without going through two-factor authentication (2FA) for each request. If a key leaks, an OTP cannot protect that access. Restricting permissions is therefore the first and most important defense.

Why bots and automated trading need keys

Strategies such as scalping and grids may need to check prices and place orders several times per second, beyond manual clicking. Bots communicate through API keys and repeat price lookup → signal assessment → order placement → fill confirmation. Giving a bot a key means delegating part of your account authority. The permissions you grant are central to security.

Read, trade and withdrawal permissions

The key-creation screen lets you select permissions. Grant only the minimum required for the purpose.

The essential rule is: do not enable withdrawal permission. Automated trading does not require it. Trade permission lets a bot buy and sell but not withdraw assets externally, confining the damage from a leaked key to activity within the account. For simple monitoring, omit trade permission too and issue a read-only key.

Restrict access with an IP allowlist

An IP allowlist permits a key to work only from approved IP addresses. Requests from unregistered addresses are rejected even if an attacker has the key. Disabling withdrawals limits the damage; an IP allowlist can prevent a leaked key from being used elsewhere.

• It is most effective when the bot runs on a server with a fixed IP, such as a VPS or cloud server.
• Some exchanges effectively require IP registration for keys with trading permission.
• Home connections often have changing IP addresses, which can unexpectedly stop a bot. A fixed-IP environment is preferable for automated trading.

Exposure risks and security habits

Keys leak more easily than expected: through hard-coded credentials uploaded to GitHub, screen sharing, screenshots or entry into fake bot sites. As part of avoiding scams, follow these rules.

1. Make withdrawals OFF and IP allowlist ON the default.
2. Store the secret in environment variables or a separate configuration file, not directly in code, and never upload it to a public repository.
3. Issue separate keys for different bots or uses so a problem requires revoking only the affected key.
4. Rotate keys every 2–3 months by revoking and reissuing them.
5. Immediately delete unused keys and keys entered into sites of uncertain origin.

Even well-restricted permissions cannot prevent losses if capital management and position sizing fail. Automated trading runs 24 hours a day. Separate from key security, consider the bot's potential maximum loss in advance and connect only capital you can afford to lose.