CoinSpider logoCoinSpider
Language: English
English中文日本語한국어
Menu
ProductWho it's forWhy usPricingLearnFAQ
Open web app
  1. Home
  2. Learn

Binance API Key Security: 6 Things to Set Before Using Any Trading Bot

Updated

A trading bot places orders through an API key. Think of the key as one that only opens certain doors: with the right permissions the bot can trade but never touch your money; with the wrong ones, the risk is completely different. Here is what to set up before connecting any bot.

1. Never enable withdrawals

This matters more than anything else. A legitimate trading bot needs read and spot-trading permission only. With withdrawals off, even a leaked API key cannot move assets out of your account. If a tool asks you to enable withdrawals, walk away.

2. Enable only what's needed

  • Enable Reading: required to see balances and holdings.
  • Enable Spot & Margin Trading: required for automated spot trading. A spot-only tool doesn't need futures.
  • Enable Withdrawals: leave it off.
  • Universal transfer, futures and other permissions: leave them off unless you know exactly why you need them.

3. Use an IP whitelist where possible

If the service publishes fixed server IPs, add them to the API key's IP access restriction, so a stolen key only works from those servers. Binance also limits how long unrestricted keys stay valid, which doubles as a reminder to review them.

4. One API key per tool

Don't share one key across platforms. Create and label a separate key for each tool, so if something goes wrong you can delete just that one.

5. Guard the secret key

The secret key is shown only once. Enter it only in the official app or website. Never screenshot it, paste it into a chat, or hand it to anyone claiming to be support.

6. Review regularly and revoke freely

  • Check the API management page every so often for which keys exist and when they were last used.
  • Delete the key as soon as you stop using a tool.
  • If you see orders you don't recognize, delete the key first, then investigate.

How CoinSpider handles it

CoinSpider needs read and spot-trading permission only, and actively checks every key: if withdrawals are enabled, the connection is refused. Your funds stay in your own Binance account, coins you held before connecting are protected from the engine, and deleting the key on Binance ends all access immediately.