API Key Permissions

An API key is a credential that lets software act on an exchange account without a password, and its permissions decide how much it can do. Venues typically separate reading, trading and withdrawal, and the separation is the whole safety mechanism: a key with read access can report balances, a trading key can move positions, and only a withdrawal-enabled key can send funds off the platform. Most third-party tools need reading and trading and nothing more, so a request for withdrawal permission is worth refusing outright. Two further controls matter where they exist — restricting a key to specific IP addresses, and giving it an expiry — because a leaked key with neither is usable by anyone, from anywhere, indefinitely. Keys are also independent of the account password and of two-factor authentication, so changing a password does not disable a key that has already been issued.