Connecting a trading bot safely: API key security in practice

By the Ozelinx editorial team · Published 2026-10-23 · Updated 2026-10-23 · 9 min read

When you connect a trading bot to an exchange, you hand it an API key: a pair of long strings that let software act on your account. Done carefully, this is a low-risk arrangement. Done carelessly, it is one of the most common ways people lose money in crypto without ever being “hacked” in the dramatic sense. This guide covers the practical steps that make the difference.

Understand what an API key can do

On most exchanges an API key has separate permissions that you switch on individually. The names vary, but they usually come down to:

• Read — view balances, orders and trade history.
• Trade (spot, margin or futures) — place and cancel orders.
• Withdraw — move funds off the exchange.
• Transfer — move funds between your own sub-accounts or wallets.

A trading bot needs read and trade access for the markets it uses. It never needs withdrawal rights. Reputable bot providers state this explicitly and will refuse keys with withdrawals enabled. If any service asks you to enable withdrawals, stop there.

Why does trade-only access still matter? Because a key that can trade can also be abused to trade badly. A known attack pattern is to use stolen trade-only keys to buy an illiquid coin at inflated prices from an account the attacker controls. Your funds never leave the exchange, but they end up converted into something nearly worthless. The defences below exist mainly to make that kind of abuse difficult.

Create the key the right way

1. Use a dedicated sub-account. Most large exchanges let you create sub-accounts. Put only the capital you intend the bot to trade into a sub-account, and create the key there. If something goes wrong, the damage is capped.
2. One key per service. Never reuse a key across two bots. Separate keys let you revoke one without breaking the other, and they make it obvious which service did what.
3. Enable only the permissions needed. Spot bot? Enable spot trading and nothing else. Leave futures off unless you are actually running futures.
4. Restrict by IP address. Bot providers publish the IP addresses their servers use. Adding them to the key’s allow-list means a stolen key is useless from anywhere else. For self-hosted bots, use your server’s static IP. Some exchanges also expire keys without an IP restriction after a set period, which is another reason to set it.
5. Name the key clearly, for example “grid-bot-provider-x-2026”, so it is easy to identify later.

Store and handle the secret carefully

The secret half of the key is usually shown only once. Paste it directly into the bot’s connection screen and nowhere else. Avoid saving it in notes apps, screenshots, chat messages or email. If you need a backup, a password manager is the right place.

For self-hosted bots, the secret ends up in a configuration file or database on your machine. Treat that machine as sensitive: keep the operating system updated, use full-disk encryption, avoid running unrelated software on a trading server, and never commit configuration files to a public code repository. Accidentally publishing keys to GitHub is a frequent, entirely avoidable source of leaks; automated scanners find them within minutes.

Protect the account around the key

The API key is only one door. Make sure the others are locked too:

• Use a unique, long password for the exchange and for the bot platform.
• Turn on two-factor authentication with an authenticator app or a hardware security key rather than SMS where possible.
• Enable withdrawal address allow-listing on the exchange, so that even a compromised login cannot send funds to a new address without a delay and confirmation.
• Be wary of “support” messages on Telegram, Discord or social media. Real support teams do not ask for your API secret, password or two-factor codes.

Monitor and rotate

Set a reminder to review your keys every few months. Delete keys for bots you no longer use; old forgotten keys are a common weak point. Rotating active keys periodically — creating a new one, updating the bot, then deleting the old one — limits how long a silently leaked key remains useful.

Turn on the exchange’s email or app notifications for logins, new API keys and large trades. An alert about a key you did not create is the earliest warning you will get.

If you suspect a leak

Act in this order:

1. Delete the API key on the exchange. This is immediate and stops the bot and anyone else using it.
2. Cancel open orders in the affected account and review recent trades.
3. Change your exchange password and check two-factor settings and withdrawal allow-lists.
4. Contact the exchange’s support through its official website or app, not through links in messages.
5. If the bot provider announced a security incident, follow its instructions and revoke every key you ever gave it.

A quick checklist

• ✅ Sub-account with limited capital
• ✅ Trade-only permissions, withdrawals off
• ✅ IP allow-list set to the provider’s published addresses
• ✅ Secret stored only in the bot and a password manager
• ✅ 2FA and withdrawal allow-list enabled on the exchange
• ✅ Calendar reminder to review keys

None of these steps takes long, and together they turn a stolen key from a disaster into an inconvenience. For an overview of how different platforms handle custody — cloud, exchange-native and self-hosted — see What are crypto trading bots?.

This guide is general information, not financial advice. Crypto assets are volatile and you can lose all the money you invest. See our risk disclaimer.