Limiting API Permissions for a Trading Bot
Most exchanges offer API key settings with scopes you should tighten before connecting a bot. Here's the practical checklist:
1. Grant the minimum scope needed
- Enable trading only, disable withdrawals — this is the single most important limit. Even if your API key leaks, the worst an attacker can do is open trades, not drain your funds.
- If your bot doesn't place orders (e.g. it only reads prices), use a read-only key with no trading permissions at all.
- Disable universal withdrawals if your exchange uses that permission type.
2. IP allowlisting
- Bind the key to the specific IP address(es) your bot runs from (VPS, home IP). Any request from another IP is automatically rejected. This neutralizes most stolen-key scenarios.
3. Access to specific accounts only
- On exchanges that support sub-accounts (Binance, Bybit, OKX, KuCoin...), create a dedicated sub-account for the bot and fund it only with what you want it to trade. Never expose your main account's key.
4. No delete/modify permissions
- Some exchanges expose permissions like "modify API key" or "delete key." Keep those off — a compromised key that can edit its own permissions defeats the point.
5. Hard limits on the bot itself
Independent of the exchange:
- Set max order size and max position size in the bot's config (many bots support a "max trade size" / daily loss limit).
- Use stop-losses and a daily loss cap so a bug or runaway loop doesn't blow through the account.
- Consider read-only for paper trading first to validate the bot before giving it real order authority.
The mental model
Treat the API key like a car key with a governor: it can trade, but it cannot withdraw, only works from one IP, and only on a sub-account with limited funds. Even a fully leaked key then has a small blast radius.
Want to see which exchanges support granular API scopes (sub-accounts, IP allowlisting, withdrawal-toggle)? I can pull our exchange directory and show the ones that fit — just let me know your region or which exchange you use.