Spoke · Grid & Exchange

How to Connect Your Exchange API Safely: A Beginner's Checklist

Updated 2026·4 min read·Beginner

Image Placeholder · Hero 16:9

A Hawk perched at a secure teal gate in dark fog, wings slightly spread as if guarding passage, amber safe-signal spark above the gate, misty mountains behind, dark cinematic fintech-noir, near-black background, electric emerald-teal glow (#3ecf8e) as the key light source, subtle amber-gold spark accent (#f5a70b), atmospheric misty pine forest and mountains, a glowing green candlestick chart subtly integrated, photorealistic, dramatic rim lighting, high detail, moody, 16:9 cinematic wide composition, clean plate, no text

Quick Answer

To connect an exchange API safely, scope the key so a bot can trade but never withdraw. In order:

Create a new, dedicated API key for this bot only.
Enable trade permission, and leave withdrawal OFF.
Add an IP whitelist so the key works only from the bot's server.
Save the secret once, then rotate or revoke it if anything looks off.

An exchange API key is a set of permissions you control, not a password to your account.

A trade-only key lets a bot open and close positions. It cannot move your coins off the exchange or change your login.

So the whole thing comes down to one switch.

Grant trade, deny withdrawal, and the worst a rogue bot or a leaked key can do is place bad trades you can see and stop. It can never empty your account.

Flip the switches below the way you would on your exchange, and watch the safety score move.

Interactive · Try it

The Restricted Key Builder

Flip the switches the way you would on your exchange and watch your safety score move. One switch does most of the work, and one switch can undo all of it. Try to reach a locked-down key.

0/100

Not started

Flip trade on to let the bot work, then add protections. Leave withdrawal off.

A teaching model of exchange API permissions, not your real account. The safe target is a dedicated key with trade ON, IP whitelist ON, and withdrawal OFF. Always confirm the real settings on your own exchange.

A key is a permission slip you write. You decide what the bot can touch, and you can revoke it in one click.

One honest caveat: this protects your coins, not your P&L.

A trade-only key stops theft, not a bad trade, and no API setting removes market risk.

Bonus · Go Deeper

Permissions

What an exchange API key actually gives a bot

An API key is a set of permissions, not a password. You set them per key, and a trading bot only ever needs two of the three: it is a labelled key to one room, not the master key.

The three permission labels

Read lets a bot see your balances and prices. It can look, never act.

Trade lets it buy, sell, open and close. That is the whole job of a trading bot.

Withdrawal lets it send your coins off the exchange. A trading bot never needs this, so you never grant it.

Your coins never leaving your own exchange is the non-custodial model, the safety floor you should refuse to go below. More in custodial vs non-custodial trading bots.

The one switch

The one permission you must never enable (withdrawals)

Never enable withdrawal permission on a trading-bot key. It is off by default, a bot does not need it to place a single trade, and it is the one setting that turns a survivable mistake into a total loss.

If a bot insists it needs withdrawal access to work, that is the red flag. Close the tab.

Reality check: withdrawal is the only door that empties the room

A trade-only key that leaks is a headache. A key with withdrawal enabled that leaks is a disaster: not a percentage of your funds, but all of them.

This is not hypothetical. In December 2022, the bot platform 3Commas was breached: attackers leaked roughly 100,000 customer API keys, and around $20 million in user funds was drained.

The keys that got emptied had one thing in common: they allowed more than trading.

API keys leaked in the 2022 3Commas breach

CoinDesk / Cointelegraph

User funds stolen, estimated

SiliconANGLE / Halborn

What a trade-only key can withdraw

By design

Read the last number twice. A key with withdrawals off can move nothing, no matter who holds it. Users who had scoped to trade-only kept their coins.

You cannot control whether a platform gets breached. You can control whether a leaked key can take your money.

Setup

Creating a restricted API key, step by step

Open your exchange's API settings, generate a new key, tick trade only, leave withdrawal disabled, add an IP whitelist, and save the secret once. On Binance, Bybit, Coinbase and Kraken alike it takes about five minutes.

Create a new, dedicated key

One key per bot, so you can revoke it without breaking anything else.

Enable trade, disable withdrawal

Tick read and trade, leave withdrawal off, and turn off internal transfers too. Least privilege wins.

Add an IP whitelist

Lock the key to the bot's server, so a leaked key is useless elsewhere. On Bybit a key without a whitelist also expires after three months, a common reason a bot quietly stops.

Save the secret once

The exchange shows it a single time. Paste it into the bot and nowhere loose: no screenshots, no notes app.

Test small, then rotate

Run a small amount first, then rotate the key every few months. Fresh keys shrink the window any old leak could use.

Image Placeholder · In-body 16:9

A teal API key shape with a lock icon, specific permission slots lit in teal (trade) and dark (withdraw), amber lock-confirmed spark above, abstract cinematic no text, dark cinematic fintech-noir, near-black background, electric emerald-teal glow (#3ecf8e) as the key light source, subtle amber-gold spark accent (#f5a70b), atmospheric misty pine forest and mountains, photorealistic, dramatic rim lighting, high detail, moody, 16:9 cinematic wide composition, clean plate, no letters, no numbers

The screen differs by exchange, but the switches are the same. We walk the venue steps in the best trading bot for Bybit and the best trading bot for Binance.

If it leaks

What to do if your API key is compromised

Revoke the key on your exchange immediately, then create a fresh one and re-scope it to trade-only. Revocation is instant and one click. If withdrawals were off, you have a scare, not a loss.

Do this straight away

✓Delete the key in your API settings. This revokes it instantly.

✓Check open positions and orders for anything you did not place, and close them.

✓Create a new key, trade-only, with a fresh IP whitelist, and reconnect the bot.

Never do this

✗Do not "wait and see." A leaked key is a live threat until you revoke it.

✗Do not reuse the leaked secret or the same label. Start clean.

✗Do not enable withdrawals to "make the bot work again." That was never the problem.

If a bot ever pressures you to loosen these settings, read how to spot a crypto trading bot scam before you touch anything.

For the bigger picture, read the pillar guide, grid trading bots explained.

This article is educational, not financial advice. Crypto is high-risk and you can lose money with any automated strategy. No API setting removes market risk. Confirm permissions on your own exchange before connecting anything.

The TRAPR Edge

* Pitch warning

TRAPR only ever asks for a trade-only key

This whole post argues for a key that can trade but never withdraw.

That is the only key TRAPR will ever ask you for: trade-only, with withdrawals disabled at the key level, so it places trades but can never move your coins. The core runs unleveraged, with no liquidation cliff, and every plan from the free Accumulator up connects the same way.

withdrawal permission on the API key fn4

disaster stop from average to liquidation

It cannot cash you out, because the permission to do so was never granted. Verify the setup yourself, then start free.

Illustration only. Not a real backtest, not a return promise, and not financial advice.

FAQ

Common Questions About Connecting an Exchange API

Is it safe to give a trading bot my API keys?+

Yes, when the key is scoped correctly. Create a dedicated API key with trade permission on and withdrawal permission off, add an IP whitelist, and the bot can place trades but cannot move your coins off the exchange. An API key is a set of permissions you control, not a password to your whole account.

Can a bot withdraw my crypto with an API key?+

Only if you grant withdrawal permission on the key. Withdrawal is a separate switch that is off by default on every major exchange. A trade-only key can open and close positions but cannot send your coins to another wallet, so leave withdrawals off and the worst case is bad trades, not a drained account.

Should I give a trading bot withdrawal permission?+

No. A trading bot never needs withdrawal access to place trades. If a bot requires it to work, treat that as a serious red flag and do not connect. Enable trade permission, leave withdrawals off, and you keep the one lever that matters.

How do I connect an exchange API to a bot?+

Generate a new API key in your exchange's API settings, enable trade permission only, leave withdrawal disabled, add an IP whitelist if the bot runs from a fixed server, then paste the key and secret into the bot once. The exchange shows the secret a single time, so store it in the bot and nowhere loose.

What happens if my API key is leaked or stolen?+

If the key is trade-only with withdrawals off, a thief still cannot move your coins, and an IP whitelist blocks the key from any other machine. Revoke the key on your exchange immediately, create a fresh one, and re-scope it. In the 2022 3Commas breach, keys with withdrawals disabled were the ones that survived intact.

Do I need to whitelist an IP for my API key?+

It is strongly recommended when your bot runs from a fixed server. An IP whitelist locks the key to that one address, so a leaked key is useless from anywhere else. On Bybit there is a second reason: a key without an IP whitelist expires after three months, which is a common reason bots quietly stop trading.

Is 3Commas safe now after the 2022 breach?+

3Commas has since rebuilt its security, but the 2022 incident is the reason API hygiene matters. Attackers leaked around 100,000 customer API keys and roughly $20 million was stolen. Users who had disabled withdrawal permission were protected, which is the lesson to carry to any platform: scope the key yourself and never rely on the operator alone.

Sources

CoinDesk and Cointelegraph (December 2022). An anonymous account leaked tens of thousands of 3Commas customer API keys; the company confirmed the breach, with reports of roughly 100,000 keys exposed.
SiliconANGLE and Halborn breach analysis (December 2022 / 2023). Compromised 3Commas API keys were used to steal an estimated $20 million from affected users; keys scoped without withdrawal permission were not drained.
Major exchange API documentation (Binance, Bybit, Coinbase, Kraken), 2026. API keys can be scoped per permission (read, trade, withdraw), withdrawal is separate and off by default, and IP whitelisting is supported.
Bybit Learn, "How to Create a Bybit API Key" (2026). Keys can be scoped to read and trade only; withdrawal is not recommended for a trading bot; keys without an IP whitelist expire after three months.
TRAPR (TAP) published strategy fact-sheet. Non-custodial by design, trade-only key, withdrawals disabled at the key level; an unleveraged core with no liquidation cliff, leverage optional and off by default, 3 safety orders as the default.