API key safety for trading bots: how to connect a bot without handing over your account

BotIndex editorial team · Updated 5 Nov 2026 · Editorial policy

What an API key is and what it can do

An API key is a pair of credentials (a public key and a secret, and on some exchanges a passphrase) that lets software act on your exchange account without your login password. Third-party bot platforms such as 3Commas, Cryptohopper, Bitsgap and Gainium all work this way: you create a key on the exchange and paste it into the platform.

What the key can do depends on the permissions you tick when you create it. OKX’s API FAQ lists three core permissions that can be combined on one key:

• Read: view balances, orders and history.
• Trade: place and cancel orders.
• Withdraw: move funds off the exchange.

A bot needs the first two. It never needs the third. That single choice decides whether a leaked key can cost you some money through bad trades or empty your account outright.

Is it safe to give a bot API keys?

It is as safe as the key is narrow. A key limited to trading, locked to the bot’s servers and sitting on an account with only the bot’s money is a contained risk. A key with withdrawals, no IP restriction and access to your main balance is close to handing over the account.

There is also a risk you don’t control: the platform storing your key. In December 2022, 3Commas confirmed that some users’ “API keys, secrets and passphrases” had been disclosed by a third party. The setup below is about limiting the damage when, not if, something on the chain fails.

How to create an API key for a trading bot: the safe setup checklist

Exchanges use different menu names, but the steps are similar. Here is what to do, with what two exchanges’ own help pages say.

1. Enable read and trade only, never withdrawals

Tick read and the trade types your bot uses (spot, futures or margin). Leave withdraw and transfer off. KuCoin’s API guide goes further for third-party apps: when you link a key to an external platform, withdrawals are not allowed at all. If a bot platform’s setup guide asks for withdrawal rights, treat that as a reason to stop.

2. Bind the key to the bot’s IP addresses

An IP whitelist means the exchange only accepts requests from the addresses you list, so a stolen key is useless from anywhere else. OKX lets you link up to 20 addresses per key, and KuCoin says you must add an IP to the whitelist before you can enable permissions.

Use the bot platform’s server IPs, not your home IP. Gainium’s security guide makes this point directly and publishes its server addresses for this purpose. OKX also runs a third-party app IP whitelist: when you set a key’s purpose to “Binding third-party apps” and pick the app, OKX only accepts requests from that broker’s registered servers.

IP binding also affects whether a key survives. OKX deletes keys with trade or withdraw rights and no IP binding after 14 days of inactivity. KuCoin deletes trade-enabled keys without an IP, or disables their trading, after 30 days of inactivity.

3. Use a separate sub-account with only the bot’s funds

Create a sub-account, move in only what the bot is meant to trade, and create the key there. If the key is abused, the damage stops at that balance. OKX’s FAQ says to create the key under the intended sub-account and warns against mixing a parent account’s key, secret or passphrase with a sub-account’s.

4. Turn on 2FA everywhere

Exchanges usually require 2FA to create a key; KuCoin asks for your trading password, an email code and a Google verification code. Gainium recommends 2FA on both the exchange and the bot platform, calling it the first step to protect access to your keys. A key is only as safe as the accounts that can create or view it.

5. Restrict trading pairs if the exchange allows it

Gainium suggests a token whitelist on the key if you only trade certain pairs, because attacks with trade-only keys tend to target low-cap tokens (more on that below).

6. Revoke keys you no longer use

Every old key is a door left open. When you stop a bot or leave a platform, delete the key on the exchange, not just in the bot. Store the passphrase yourself: OKX says it cannot be viewed after creation, and if you lose it you have to delete the key and make a new one.

7. Never paste keys into chats, Telegram or unknown sites

Paste a key only into the bot platform’s own connection page, reached by typing its address yourself. Nobody legitimate needs your secret in a DM, a Telegram “support” chat or a form linked from a social post. If someone asks for it, assume it’s a scam.

Permissions to enable vs disable

What can still go wrong with a trade-only key

Turning off withdrawals stops the obvious theft. It doesn’t stop someone with your key from trading your balance badly on purpose.

Gainium describes this as “contra trading,” a market manipulation tactic where an attacker generates enough trading volume to move a price, usually on lower-cap tokens because they take less volume to move. In practice the risk looks like this. Example: an attacker holds a cheap, illiquid token and uses your key to buy it with your 1,000 USDT at inflated prices, selling their own tokens into your orders. Your account ends up holding a token worth far less, and no withdrawal ever happened.

The second risk is the platform itself. Here is what 3Commas’ own notice says about December 2022:

• On December 28, 2022, a purported hacker posted on Pastebin claiming access to 3Commas’ API data. 3Commas says it learned of the incident from that post.
• 3Commas confirmed that some users’ API keys, secrets and passphrases were disclosed. It said it believed only API data was affected, and it did not state how many users were involved.
• The hacker alleged an employee sold the data. 3Commas said its internal investigation found no evidence of employee involvement and that it was investigating with law enforcement.
• It warned that the keys could be used to link users’ exchange accounts to the attacker’s or to make unauthorized trades.
• It asked Binance, KuCoin and other supported exchanges to revoke all keys connected to 3Commas, and strongly recommended that every user reissue their API keys.

The notice also lists measures added since, including stricter encryption, isolated API key environments and real-time checks of exchange-side key restrictions. You can read more in our 3Commas review. The point for any platform: your key lives on someone else’s servers, so IP binding and sub-account limits are what protect you if those servers leak.

Built-in exchange bots vs third-party platforms

The bots built into exchanges like Bybit, OKX, KuCoin and Pionex run inside your exchange account. You start them from the exchange’s own app or website, so there’s no API key to create, copy or store anywhere else. That removes the third-party storage risk entirely.

Third-party platforms need a key per exchange. In exchange you get one dashboard across several exchanges: our data shows 3Commas connecting to 9 exchanges and Bitsgap to 17. If you want that, see multi-exchange bot platforms, and apply every step of the checklist above to each key.

Neither option protects you from a bad strategy. A built-in grid bot can lose money just as easily; it just can’t leak a key it never had.

What to do if an API key leaks

Act in this order:

1. Revoke the key on the exchange. Delete it in API management. Deleting it in the bot platform alone does not stop someone who already copied it.
2. Check open orders, trade history and balances. Look for trades you didn’t make, especially in small, illiquid tokens, and cancel any orders you don’t recognize.
3. Check the rest of the account. Review other API keys, sub-accounts and security settings, and change your exchange password and 2FA if you think more than the key was exposed.
4. Contact the exchange’s support through its official site or app, with times and order IDs of anything suspicious.
5. Create a new, restricted key only after the cause is clear, following the checklist above. After its 2022 incident, 3Commas also suggested reporting to police and keeping in touch with its support.

None of this guarantees you get anything back. The cheapest protection is the setup you choose before the first trade.

FAQ

Sources

• 3Commas — Notice on API data disclosure incident ↗checked 5 Nov 2026
• OKX — OKX API FAQ ↗checked 5 Nov 2026
• OKX — Third Party App IP Whitelist Launch ↗checked 5 Nov 2026
• KuCoin — How to Create API ↗checked 5 Nov 2026
• Gainium — Enhancing security of your exchange API keys ↗checked 5 Nov 2026

Not financial advice. Trading bots do not remove market risk.