API key hygiene

Sooner or later you will connect something to your exchange account: a portfolio tracker, a tax tool, a charting platform, a bot. Every one of those connections is an API key, and an API key is a second front door to your money that bypasses your password and 2FA entirely. Most exchange account drains that make the news involve a key, not a login.

What an API key is

An application programming interface (API) key is a pair of strings, a key and a secret, that lets software act on your account without logging in through the website. When you create one, the exchange asks what the key is allowed to do. The typical permissions are:

• Read: view balances, orders, trade history.
• Trade: place and cancel orders.
• Withdraw: move funds off the exchange.

A key with only read permission is harmless if leaked in isolation; the worst outcome is that someone knows your balance. A key with withdraw permission that leaks is your balance gone.

The permission rule

Grant the minimum the tool needs and nothing more:

There is almost no legitimate reason for a third-party service to hold a withdraw-enabled key. If a service insists on it, that is a reason not to use the service.

IP restriction

Most exchanges let you bind a key to a list of IP addresses. A key bound to your tax software's published server IPs cannot be used from anywhere else, even if it leaks. Use this wherever the service supports it. For a bot you run yourself, bind the key to that machine's static IP.

The trade-only key is not safe either

Beginners assume a key without withdraw permission cannot cost them money. It can. A stolen trade-enabled key can:

1. Sell all your holdings into a worthless token that the attacker is on the other side of, on a thin pair where they hold the asks. Your money is extracted through the order book rather than a withdrawal.
2. Open a maximum-leverage perp position that gets liquidated within minutes.
3. Churn thousands of trades to run up fees.

This is a common attack pattern precisely because people believe trade-only keys are low risk. Treat any trade-enabled key as capable of emptying the account and scope it accordingly: IP-restricted, on a sub-account that holds only trading capital, with a short expiry.

Key idea: An API key is a door that skips your password and 2FA. Read-only by default, never withdraw, IP-restricted, on a sub-account, and rotated on a schedule. A trade-only key can still drain you through the order book.

Storage and rotation

• Copy the secret once, into a password manager entry, and never into a chat, email, note app or screenshot. The exchange will not show it again.
• Never commit a key to a code repository, including private ones. Automated scanners find keys in public repositories within seconds of a push.
• Set an expiry where the exchange offers one (90 days is a reasonable default). Delete keys for tools you have stopped using.
• Keep a simple list: which key, which service, which permissions, which date. Review it monthly alongside your device list.
• If a service you gave a key to is breached, or you are unsure, delete the key first and think second. Creating a new one costs a minute.

Signs a key has been compromised

• Trades in your history you did not make, especially in obscure pairs.
• Orders appearing and vanishing.
• Login or API notifications from unfamiliar locations.
• A sudden balance change with no withdrawal.

Response: delete all API keys, change the password, check 2FA is still yours, review the withdrawal whitelist, then contact the exchange. In that order; the keys are the live threat.

Try it: Open the API management page on your exchange. Count the keys. For each, write down the service, the permissions, the IP restriction, and when you last used the service. Delete every key that fails any of: unused in 30 days, has withdraw permission, or you cannot remember what it is for.

Recap

• API keys bypass passwords and 2FA; they are a second door to the account.
• Grant minimum permissions. Read-only for trackers and tax tools; never withdraw for anything.
• Trade-only keys can still drain you via thin order books or leveraged positions, so IP-restrict them and use sub-accounts.
• Store secrets only in a password manager, never in code or chat, and set expiries.
• Unexplained trades in odd pairs are the classic sign of a stolen key; delete keys first, investigate second.