Trade-Only API Keys: Connecting a Bot Without Handing Over Your Money
Jonny Bravo
-Trade-Only API Keys: Connecting a Bot Without Handing Over Your Money
Every automated trading setup begins with the same uncomfortable act: giving software access to your exchange account. Done carelessly, you've handed a program — and whoever compromises it — the keys to your money. Done properly, you've handed it something much narrower: permission to trade, and nothing else. The difference is a few checkboxes, and those checkboxes are the most important security decision in your entire setup.
The permission model, and the only rule that matters
Every major exchange scopes API keys by permission — typically read (balances, positions, history), trade (place and cancel orders), and withdraw (move funds out). The rule is absolute:
A trading bot needs read and trade. It never, under any circumstances, needs withdraw.
There is no legitimate automation reason for a strategy engine to hold withdrawal rights. With withdrawals disabled at the key level, the exchange itself enforces that your funds cannot leave the account — not the bot's code, not the platform's promises, the venue's own permission system. A leaked trade-only key is a bad day: someone could churn your account with hostile orders. A leaked withdrawal-enabled key is a terminal event. That asymmetry is the whole argument, and it's why "withdrawals stay disabled" is a load-bearing sentence in any serious platform's security story — including ours.
Setting it up, venue by venue
The flow is near-identical everywhere; the checkbox names move around:
- Binance — create the key, enable Enable Reading and Enable Spot & Margin Trading (and Enable Futures if you trade perps). Leave Enable Withdrawals off. Add an IP allowlist — Binance grants long-lived keys only to IP-restricted setups, which is the right pressure.
- KuCoin — permissions are General (read), Trade, Withdraw; grant the first two only. KuCoin also requires a per-key passphrase — treat it as a second secret; a platform that stores it should encrypt it like one.
- Bybit — choose read-write scoped to trading; leave withdrawal off. On a Unified Trading Account, note which wallet your funds sit in — a bot reading the UTA can't see what's parked in the Funding wallet.
- Hyperliquid-style DeFi venues — the model differs: access is a wallet signature, and the safe pattern is an agent/API wallet that can sign orders but is not the wallet that custodies funds. Same principle, different mechanics: the trading credential cannot move money out.
Whatever the venue: one key per application, never reused. Separate keys mean a compromise has a blast radius of one, and revocation doesn't take down everything else you run.
The IP allowlist is worth the friction
Locking a key to specific IPs means a stolen key is useless from anywhere else on the planet. The friction is real — the platform's egress IPs have to be stable and known — but it converts "secret leaked" from an incident into a non-event. A platform built for this publishes its execution IPs so you can allowlist them at key creation; ours does, and the account layer keeps every stored credential encrypted at rest and decrypted only at the moment of execution.
Five questions to ask any platform before pasting a key
- Do you ever ask for withdrawal permission? Any "yes" — for "rebalancing", "fee collection", anything — is disqualifying.
- How are keys stored? The answer should include encryption at rest and decryption only at point of use — not "in the database."
- Can I see every order the key places? You should be able to audit the bot's activity on the venue's own order history, independent of the platform's UI.
- What are your egress IPs? If they can't tell you, you can't allowlist them.
- What happens when I revoke? The right answer is graceful degradation and a clear error surface — not a system that trades on stale assumptions.
Revocation is also your kill switch, and it's a good one: delete the key on the exchange and every venue-side ability the platform had evaporates instantly, no support ticket required. A well-scoped key plus a known revocation path means the worst-case story has a boring ending — which, in trading infrastructure, is the best kind.
Connect with trade-only keys — withdrawals stay disabled, secrets encrypted at rest, every order visible on your own venue. Connect an account safely →
Related reading