Exchange API Keys: How to Create Them and Not Lose Money

Some traders lose money because someone gains access to their account through a badly configured API key. It happens all the time — especially to people who plug in third-party terminals or bots without thinking through the implications.

Let's cover everything in order: what an API key is, why traders need one, how to create one on Binance and Bybit, which permissions to grant, and how to set up proper security.

What Is an API Key

An API key (Application Programming Interface key) is a pair of strings — Access Key + Secret Key — that gives a third-party application access to your exchange account. Without your login or password.

Here's how it works. The exchange generates a unique pair: a public key (which identifies you as a user) and a secret key (which signs every request). When a trading terminal wants to place an order or pull order book data, it sends a request to the exchange servers signed with the secret key. The exchange checks the signature, verifies the key's permissions, and either processes the request or rejects it.

The secret key is shown exactly once, right after creation. Never again. If you didn't save it, you'll have to generate a new one.

Why does a trader need this? Three main scenarios:

• Connecting a trading terminal to work with the order book, tape, and place orders quickly.

• Running trading bots and automated strategies.

• Exporting trade history to analytics tools or a trading journal.

In all three cases, the API key is the entry point into your account. A well-configured key gives controlled access. A poorly configured one leaves the door open.

How to Create an API Key on Binance

Log into your Binance account. Click the profile icon in the top right corner, then select "API Management" from the dropdown.

The system will ask you to verify via email or 2FA. After that, click "Create API."

The exchange will offer two modes:

System-generated key. Binance creates the key pair itself. The standard route for most traders.

Self-generated key (Ed25519). You generate the keys on your end and upload the public key. Overkill for everyday use.

Choose the first option and give it a label — something like "scalping_terminal" or "bybit_bot." Name your keys so you can tell them apart later. Five unlabeled keys and you won't know which one to delete when the time comes.

After creation, the system shows both the API Key and Secret Key exactly once. Copy both. Save them. Don't close the window until you've confirmed the data is saved.

Permissions on Binance

The key settings page has three permission blocks:

Read (Read Info). View balance, positions, trade history. Enable.

Trading (Enable Spot & Margin Trading / Enable Futures). Place orders. Enable the markets you actually trade on.

Withdrawals (Enable Withdrawals). Permission to withdraw from the account. Never enable for trading terminals.

Separately — IP address restriction. If your provider gives you a static IP, tie the key to it. Even if someone gets hold of the key strings, they won't be able to use them from a different address. With a dynamic IP, the exchange will warn you that keys without IP binding expire after 90 days.

How to Create an API Key on Bybit

The process on Bybit is similar, just a slightly different interface.

Log into your Bybit account, click the account icon, and select "API Settings." Then hit "Create New Key."

Bybit immediately asks you to choose a type:

System-generated. Standard option for connecting to terminals.

Third-party app key. For when the app developer is registered as a Bybit partner.

Choose system-generated. Set a label. Configure permissions.

Bybit's permission granularity is higher:

• Account: "View account information" — enable.

• Trading: "View order details" and "Trade" — enable both.

• Withdrawals: "View deposit/withdrawal information" can be enabled, but leave the actual withdrawal permission off.

• Futures: "View account information," "View order details," "Order (Trade)" — enable if you trade futures.

After creation, the exchange shows the Access Key and Secret Key. Save both. Shown once only.

Which Permissions to Grant and Which to Skip

One principle: minimum permissions needed to do the job. Everything else stays off.

For a trading terminal (read the order book, place orders) you need:

• Read permissions (balance, positions, history).

• Trade permissions (spot, futures — only what you actually use).

For analytics tools or history export, read permissions only. Trading isn't needed.

What to never enable for external applications:

• Withdrawal permission. Never. If a developer says their product requires it to function, that's a reason to stop and think hard before using it.

• Account transfer permission (if the exchange offers this separately).

The logic is straightforward. A key without withdrawal rights, even in the wrong hands, can't move your money out directly. The worst case is someone trading on your funds — which is bad, but nowhere near as bad as a zero balance.

Common Mistakes With API Keys

Here's where things tend to go wrong.

Using one key for multiple applications. If one of the bots gets compromised, you don't know which key to revoke. Rule: one key per application.

Enabling withdrawal "just in case." Just in case what? No trading terminal needs withdrawal rights to work. If one claims otherwise, it's either a developer mistake or a red flag.

Storing keys in unsecured locations. A text file called "api_keys.txt" on the desktop, a screenshot in Google Photos, sending them over Telegram — these are already leaked keys that just haven't been used yet. I keep my keys in an encrypted password manager, and only there.

Not deleting old keys. A key from a bot you tested three months ago and forgot about is still an active vulnerability. Once a month, go to the API management page and clean out anything unused.

Skipping IP binding when you have a static address. Free extra security that almost nobody sets up. Takes 30 seconds.

Forgetting about time sync issues. A rarely mentioned problem: if your computer's system time differs from the exchange's server time, requests will fail with an authorization error. The keys are correct, everything is configured, nothing works. Sync your system time.

Security Rules

A few specific rules that actually hold up in practice.

Two-factor authentication on the account. Basic. Without 2FA, someone who gets your password doesn't even need an API key — they'll just log in and create their own.

Check your key list regularly. Once a month, go to the API management page and delete anything unused. Fewer active keys means a smaller attack surface.

Don't hand keys to unknown services. An "analytics bot" or "signal service" asking for trade and withdrawal permissions is either a scam or badly secured. Either way, no.

Watch the key expiry on Binance. Without IP binding, keys expire automatically after 90 days. Set a reminder.

In my experience, most incidents where people lose money through the API don't involve sophisticated hacks. Someone hands over keys with the wrong permissions, or stores them somewhere insecure. Exchange systems are technically solid enough — the weak point is the person and their habits.

When an API Key Won't Save You: Edge Cases

A few situations where even a correctly configured key won't help.

Compromised computer. If the machine has a keylogger or trojan, it can capture the keys the moment you copy them. No permission setting protects you if the key is stolen before you even use it. So security starts with an antivirus and common sense about what you install.

Phishing sites. Fake exchange or terminal websites where you "voluntarily" enter your keys. Always check the URL.

Cloud service breach. If a terminal or bot stores your keys on its servers, a single breach of that service compromises every user's keys at once. That's a systemic risk that has nothing to do with your settings.

Connecting to Secret Terminal

Secret Terminal is a scalping terminal that works with the order book, tape / time & sales, and cluster analysis. It connects to Binance, Bybit, OKX, MEXC, and WhiteBIT via API keys.

The connection process is straightforward.

• Download the terminal from the official site and install it.

• Create an API key on the exchange you need. Permissions: read + trade. Withdrawals off.

• In the terminal, go to "Settings" — "Connections" — "Add Connection."

• Select your exchange from the list.

• Paste the corresponding strings into the "API key" and "API secret" fields.

• Click "Connect."

If the connection fails, check: extra spaces when copying the key (most common cause), key permissions (read and trade must be enabled), IP binding (add your computer's IP to the whitelist if it's enabled), system time sync.

One important security note: all data in Secret Terminal is stored locally on your computer. API keys, settings, workspaces — none of it goes to the developers' servers. Only technical sync data goes to external servers for cross-device settings synchronization, and that never includes keys. This is what sets the terminal apart from cloud-based solutions.

I usually create a separate key for each connection: one for the terminal on my main machine, another for the laptop. If something goes wrong, it's immediately clear which key to revoke.

Once connected, the terminal gives you the order book with a density level map, live tape / time & sales, cluster analysis, and funding rate and listing monitoring. For a deeper look at reading the tape and using that data in your trading, see the "Scalping from Density Levels" article.

FAQ

• What is an exchange API key and what is it for?

  An API key (Binance API key, Bybit API key) is a pair of strings — Access Key + Secret Key — that gives a third-party application access to your account without entering a login and password. You need it to connect trading terminals, bots, and analytics tools. Without it, those applications can't read account data or place orders.

• Can you lose money because of an API key?

  Yes, but only if you grant withdrawal rights. A key without that permission can trade on the account but can't send funds to an outside address. The average spread on BTC/USDT during scalping is 0.01–0.03%, which at 10x leverage eats 0.1–0.3% of the position — so correct key configuration matters not just for security but for cost control. The rule is simple: never enable withdrawal rights for external applications.

• What to do if a key might have leaked?

  Go to API management on the exchange immediately and delete the key entirely. Don't edit it, don't change permissions. Delete it. Then check recent transaction history. Create a new key with the correct permissions.

• How many API keys can you create?

  On Binance and Bybit — up to 30 keys per account. In practice, there's no reason to keep more than 5–7: more keys means more points of exposure to track.

• A key expired. What happens to open positions?

  Open positions on the exchange stay open. Key expiry doesn't affect anything already on the exchange. The terminal or bot just loses access to managing those positions. Before updating keys, close your positions or be prepared to manage them directly through the exchange interface.

• Do spot and futures need different permissions?

  On most exchanges, yes. Spot and futures trading are separate permissions in the key settings. If you only trade futures, there's no reason to enable spot trading rights.

• What does "Invalid API-key, IP, or permissions" mean?

  Three possibilities: the key was copied incorrectly (check for spaces), IP binding is enabled and the request is coming from a different address, or the key is missing the required permissions. For example, no futures trading permission when trying to open a futures position.

An API key is a tool that makes a trader's workflow faster and more convenient. A correctly configured key with minimal required permissions carries minimal risk. Problems start when the trader isn't thinking about which boxes they're checking.

Simple rule: separate key for each application, only necessary permissions, withdrawals never enabled, old keys deleted, 2FA always on.

Download Secret Terminal and connect your exchange via a secure API in 5 minutes. Order book, tape, clusters — all in one interface, data stored locally.