Every trading bot connects to your exchange through an API key, a pair of codes that lets the bot place orders on your behalf. That connection is also the biggest security risk in automated trading. A leaked or misconfigured API key has drained many accounts, sometimes in minutes, and the losses are almost never recoverable. The good news is that safe API setup is straightforward once you know the rules. This guide walks through exactly how to create, restrict and monitor API keys so that even a worst-case leak cannot empty your account.

What an API key is and what it can do

An API key is made of two parts: a public key that identifies the connection, and a secret key that acts as its password. Together they let an external program, such as a trading bot, talk to your exchange account. The key's permissions decide what the program is allowed to do. Typical permissions include reading account data, placing and cancelling orders, and withdrawing funds. That last permission is the dangerous one. A bot only needs to trade, never to withdraw, so the withdrawal permission should always be switched off. If a platform insists on withdrawal access, do not use it.

Step one: create a separate key for each bot

Never reuse one API key across several bots or services. Create a fresh key for each bot, and label it clearly with the bot's name and the date you created it. This way, if one bot is compromised or misbehaves, you can delete its key without affecting the others. Use a separate exchange sub-account for bot trading when the exchange offers one, so the bot's funds are isolated from your main holdings. Keeping bot money separate is the single most effective way to limit the damage from any failure, whether it is a hack, a bug, or a strategy that goes wrong.

Step two: restrict permissions to the minimum

When you create the key, turn on only the permissions the bot actually needs. For most trading bots that means spot trading only, with futures or margin trading enabled only if the bot genuinely uses them. Turn off withdrawals, turn off transfers between accounts, and turn off any permission you do not recognise. Some exchanges also let you restrict which trading pairs a key can access. If your bot only trades Bitcoin and Ethereum, restrict the key to those pairs. The principle is simple: a key should be able to do exactly what the bot needs, and nothing else.

Step three: whitelist IP addresses

IP whitelisting is the most powerful protection available, and it is free on most major exchanges. When you whitelist an IP address, the API key only works from that address, so even if someone steals your key, they cannot use it from their own computer. If your bot runs on a home server or a VPS with a fixed IP address, whitelist that address. If your bot runs on a cloud service with a changing IP, use the service's published IP range or a fixed outbound address. After setting this up, test the connection from the bot, then test that the key fails from another network, so you know the restriction is actually working.

Step four: set limits and monitor the key

Even a well-restricted key needs limits and monitoring. Set a daily trading limit on the sub-account if your exchange offers one, so a runaway bot cannot trade unlimited volume. Check the exchange's API activity log regularly for unfamiliar orders, and set up email or app notifications for logins and large trades. Rotate your keys every few months, which means creating a new key and deleting the old one, just as you would change a password. And never store a secret key in a chat message, an email, a screenshot, or a shared document. If a secret key has ever been pasted somewhere it should not have been, assume it is compromised and replace it immediately.

What to do if a key is compromised

If you suspect a key has leaked, act in this order: delete the key on the exchange immediately, before investigating anything else. Then check your recent trades and withdrawals for anything unfamiliar, and move your funds to a fresh account if anything looks wrong. Change your exchange password and enable two-factor authentication with an authenticator app, not SMS. Finally, review how the leak happened: was the key stored in a file that was shared, pasted into a support chat, or saved in a browser? Fix the habit, not just the key. API security is mostly common sense applied consistently, and the traders who follow these steps rarely become victims. Trading involves substantial risk of loss; never trade with money you cannot afford to lose.