Crypto Exchange API Key Security: A Guide to Bots, Apps, and Third-Party Connections

Featured short answer

Related Guides

• What Should You Do in the First 15 Minutes If Your Crypto Account Is Compromised?
• Crypto Security Test
• What Is an Anti-Phishing Code?

A crypto exchange API key is an access token that allows bots, portfolio apps, accounting tools, or custom software to connect to your exchange account with specific permissions.

If an API key is not used securely, an attacker can:

• view your balance,
• open and close orders,
• incur losses in futures trading,
• withdraw funds if the API withdrawal permission is enabled,
• and use your account for manipulative transactions.

Who is this guide for?

This guide is for:

• those who want to use trading bots,
• those who connect portfolio tracking apps,
• those using accounting or tax tools,
• those setting up arbitrage, grid, copy trading, or alert bots,
• those who don’t understand the difference between an API key, API secret, and passphrase,
• those who create an API key on Binance, Kraken, OKX, Coinbase, or another exchange,
• those who accidentally uploaded their API key to GitHub,
• those who wish to grant exchange access to third-party bots,
• and those managing company or team accounts

this guide is intended for.

Critical Risk Warning

Although an API key may seem like “just technical connection information,” it can grant significant permissions.

Never do the following:

• Do not send your API secret via Telegram, Discord, or email.
• Do not hardcode the API key in plain text within your code.
• Do not post it on GitHub, Replit, Vercel logs, or an open server.
• Do not grant Trade permission if the bot does not need it.
• Do not enable Withdrawal permission unless absolutely necessary.
• Do not use a high-privilege API key without IP restrictions.
• Do not paste your own API key into a bot file provided by someone else.
• Do not create an API key with withdrawal permissions for a “profit-guaranteed bot.”

What is an API key?

An API key is an authentication credential that establishes an authorized connection between your exchange account and an external software application.

API Key: Public key / identifier API Secret: Private signing key Passphrase: An additional security phrase used by some exchanges

With this information, the software can:

• check your balance,
• retrieve order history,
• place new orders,
• cancel orders,
• view transfer history,
• and, in some cases, initiate a withdrawal.

Not all API keys are granted the same permissions.

What do API permissions mean?

Read Permission

The bot or app can only view data:

• balance,
• order history,
• transaction history,
• open orders,
• account information.

For a portfolio tracking app, read-only access is usually sufficient.

Trade / Buy-Sell Permission

The bot can open orders, cancel orders, and execute trades.

Risks:

• A faulty bot can cause losses,
• a malicious bot may force you to trade at a bad price,
• liquidation risk may arise in futures trading,
• the account may be used for manipulation purposes.

Withdrawal Permission

Crypto can be withdrawn from the account using an API key. This is the riskiest permission.

Withdrawal permission is unnecessary for most users and bots. It should only be considered in mandatory, institutional, and systems with strict IP restrictions.

Internal Transfer

On some exchanges, transfers can be made via API between the main account, sub-accounts, funding, spot, or futures wallets. Even if an attacker cannot make a direct withdrawal, they can move funds to high-risk sections.

What should the most secure API key look like?

For a portfolio tracking app

Read: Open Trade: Closed Withdraw: Closed IP whitelist: Open if possible

For a trading bot

Read: Enabled Trade: Enabled Withdraw: Disabled IP whitelist: Enabled Futures trading permission: Only if necessary

For an accounting/tax tool

Read: Open Trade: Closed Withdraw: Closed IP whitelist: Open if possible Time limit: Open if possible

For corporate automation

Minimum permissions IP whitelist required Separate sub-account Daily limit Log tracking Regular key rotation Emergency cancellation procedure

What is an IP whitelist?

An IP whitelist is a security setting that ensures the API key can only be used from specific IP addresses.

The API key should only work from the IP address 203.0.113.10. API requests from other locations should be rejected.

Without an IP whitelist, the key can be tested from anywhere in the world the moment it is compromised.

Important API security notes by exchange

Binance

For keys without IP restrictions, permissions other than read access may be limited. IP access restrictions may be required for withdrawal permissions.

Kraken

Anyone with access to the API key can perform sensitive transactions on the account. The API key, secret, and QR code information should be treated as critically as a username and password. An IP whitelist, key expiration, and permission restrictions should be used.

Coinbase

API keys should not be hardcoded, stored in the source code, or uploaded to version control. Environment variables or secure secret management should be used.

OKX

API key permissions can be managed as Read, Trade, and Withdraw; binding an IP address is recommended for security.

Step-by-step secure setup when creating an API key

Step 1: Clarify the purpose

• Is it just for portfolio tracking,
• a spot trading bot,
• futures trading,
• accounting/tax reporting,
• or an in-house system?

Don’t create an API key if your purpose isn’t clear.

Step 2: Create a new and separate key

Create a separate API key for each application.

Incorrect:

All bots and portfolio apps use the same API key.

Correct:

Bot-Spot-ReadTrade Tax-Broker-ReadOnly Portfolio-Tracking-ReadOnly

Step 3: Keep permissions to a minimum

Don’t enable “Trade” or “Withdraw” just because you “might need them.”

Step 4: Keep the withdrawal permission disabled

The trading bot does not need to withdraw funds. If the bot is going to buy and sell, “Read” and “Trade” permissions should be sufficient.

Step 5: Add an IP whitelist

If the bot is running on a server, use a static IP. If you’re using a home internet connection with a dynamic IP, keep in mind that the IP may change.

Step 6: Store your API secret securely

Secure options:

• secret manager,
• encrypted password manager,
• server environment variable,
• restricted-access configuration file.

Avoid:

• plain text .txt files,
• desktop note file,
• screenshot,
• email,
• GitHub,
• WhatsApp,
• Telegram.

Step 7: Run a small test

First, test with a small balance and a low-privilege private key.

Step 8: Set up logs and alerts

• API requests from unknown IP addresses,
• unexpected orders,
• a large number of cancellations,
• futures contract opening,
• API error rate,
• notification of a new API key creation.

Step 9: Delete unused keys

Check once a month and delete any unnecessary ones.

Where should you store your API key?

Examples of poor storage practices

Writing it in config.py Uploading the .env file to GitHub Storing it as plain text on Google Drive Posting it on the bot dashboard where anyone can see it Logging the key in server logs Taking a screenshot

More secure methods

Excluding the .env file from version control Using a secret manager Restricting server access Storing the key in an encrypted password manager Masking secrets in logs Performing regular key rotation

If it was accidentally uploaded to GitHub

Simply deleting the key from the file isn’t enough; it may still remain in the Git history.

1. Immediately revoke the API key from the exchange.
2. Generate a new key.
3. Clean up the Git history.
4. Check repo access permissions.
5. Review the bot logs.
6. Check for any unauthorized transactions on the account.

Is it safe to give API keys to third-party bots?

It’s always risky.

Questions to ask:

1. What permissions does the bot request?
2. Does it request withdrawal permission?
3. Does it provide an IP whitelist?
4. Who is the company?
5. Is the code open source?
6. Where are the keys stored?
7. Are there security audits?
8. Are the API keys encrypted?
9. Are the user reviews real?
10. Who is liable if the bot causes a loss?
11. Is there a “guaranteed profit” claim?
12. Is access truly revoked when the key is deleted?

What happens if the API key is compromised?

If you only have Read permission

An attacker can view your balance and transaction history; they cannot execute transactions directly, but there is a risk of privacy loss and social engineering.

If there is a “Trade” permission

An attacker:

• can place orders that result in losses,
• execute trades at unfavorable prices on low-liquidity currency pairs,
• open leveraged positions in futures,
• liquidate a position,
• and use the account for manipulation purposes.

If withdrawal permission is granted

they can withdraw funds. This is the most critical scenario.

If the API key is compromised, within the first 10 minutes

1. Delete the API key immediately

Simply shutting down the bot is not enough; revoke the key from the exchange’s API management dashboard.

2. Check all open orders

Cancel any unexpected orders.

3. Check your futures positions

Review your open positions, leverage, and margin status.

4. Check your withdrawal history

If withdrawal permission is enabled, check to see if any withdrawals have been made.

5. Review API logs

Check IP addresses, request times, endpoints, and order history.

6. Reset your password and 2FA

An API leak could be part of a larger account takeover.

7. Stop applications that use the API

Do not run bots without generating a new secure key.

8. Submit a support request to the exchange

If there are unauthorized transactions, include the TXID, order ID, date, IP address, and screenshots.

Secure API Maintenance Plan

Weekly

• Check open orders.
• Review bot performance and error logs.
• Check for any unexpected transactions.

Monthly

• List your API keys.
• Delete unused ones.
• Re-evaluate permissions.
• Check if the IP whitelist is correct.

Every three months

• Consider renewing API keys.
• Check your secret storage method.
• Remove old bots.
• Review the sub-account structure.

After a security incident

• Delete all API keys.
• Create new keys with new permissions.
• Reset passwords and 2FA.
• Scan devices.
• Review team members with API access.

Practical scenarios

Scenario 1: The portfolio app requires an API key

Read: Open Trade: Closed Withdraw: Closed IP whitelist: Open if possible

Scenario 2: You will be using a grid bot

Read: Open Trade: Open Withdraw: Closed IP whitelist: Open Futures: Closed if not required

Test the bot with a small amount first.

Scenario 3: The API key has been uploaded to GitHub

1. Delete the key immediately.
2. Check your account activity.
3. Clear the repo history.
4. Review open orders and withdrawals.
5. Run the bot with a new, secure key.

Scenario 4: The bot is requesting withdrawal permission

This is a red flag. A trading bot generally does not need withdrawal permission.

Scenario 5: The API key is returning an IP error

Possible causes:

• The IP whitelist is incorrect,
• the server IP has changed,
• home internet has a dynamic IP,
• the bot is running from a different server,
• the VPN changed the IP address.

Instead of temporarily lifting the IP restriction, fix the system.

Troubleshooting table

Security Checklist

• ☐ I created a separate API key for each application.
• ☐ I disabled unnecessary permissions.
• ☐ I granted only Read permission to the portfolio app.
• ☐ Withdraw permission is disabled in the trading bot.
• ☐ I used an IP whitelist.
• ☐ I did not hardcode the API secret into the code.
• ☐ I did not upload the secret to GitHub.
• ☐ I added the .env file to .gitignore.
• ☐ I do not log the secret.
• ☐ I deleted unused keys.
• ☐ I regularly check my API keys.
• ☐ I tested the bot with a small amount.
• ☐ I enabled futures trading only when necessary.
• ☐ I’ve researched third-party services that use the API.
• ☐ I know how to revoke a key in the event of a breach.

Frequently Asked Questions

What is a crypto API key?

It is access information that allows your exchange account to connect to external applications within the scope of specific permissions.

Are an API key and an API secret the same thing?

No. An API key is an identifier; an API secret is confidential information used to sign requests.

Can I withdraw funds using an API key?

Withdrawals can only be made if the "Withdraw" permission is enabled and the exchange’s conditions are met.

Is a withdrawal permission required for a trading bot?

Generally, no. "Read" and "Trade" permissions are sufficient; "Withdraw" is high-risk.

What is an IP whitelist?

It is a security setting that ensures the API key can only be used from specific IP addresses.

What should I do if my API key was uploaded to GitHub?

Immediately delete the key from the exchange, clear the repo history, check your account activity, and securely generate a new key.

What permissions should be granted to the portfolio tracking app?

Generally, "Read" permission is sufficient. "Trade" and "Withdraw" should be disabled.

If my API key is compromised, will my exchange account be completely compromised?

It depends on the permissions. "Read" can pose a privacy risk, "Trade" can result in financial loss, and "Withdraw" can lead to the loss of funds.

Can 2FA be bypassed with an API key?

Some API operations may work differently from the 2FA flow in the user interface; permissions must be very carefully restricted.

Conclusion

When used correctly, crypto exchange API keys simplify bot operations, portfolio tracking, and accounting tasks. However, an API key created with incorrect permissions or stored improperly is a serious security vulnerability.

The safest approach:

1. Create a separate API key for each application,
2. granting only the necessary permissions,
3. keeping the withdrawal permission disabled,
4. using an IP whitelist,
5. not writing the secret in the code or on GitHub,
6. deleting unused keys,
7. and revoke the key immediately in the event of a leak.

Related Safety Guides

• USDT network selection guide
• wrong-network recovery guide
• memo and destination tag guide