Exchange API key security

An exchange API key is what lets a trading bot place orders on your account. The permissions you give that key decide what a bot can and cannot do, so the key is the first and most important safety control in automated trading. This guide explains the rules Algonney applies to every key, how keys are stored, and how to create a safe key on Binance, Bybit and OKX.

What an API key can do

An exchange key is a pair of values, a public key and a secret, and sometimes a passphrase. Each key carries its own permissions, usually:

• Read: see balances, orders and positions.
• Trade: place and cancel orders on spot or futures markets.
• Withdraw and transfer: move funds out of the account or between accounts and wallets.

A bot needs only the first two. A key that can withdraw is a key that can empty your account if it leaks, whatever platform holds it.

The rules every key must pass

Algonney checks every key with the exchange before it is used. The rules are fixed safety rules: no setting, plan or support request turns them off.

• No withdrawal, transfer or wallet permission. A key with any of them is refused.
• Read and trade are required. The platform needs to see your balances and positions and to place protective orders.
• IP binding is required. The key must be restricted to the server IP address shown on the connect form. A key without an IP binding is refused.
• Two-factor authentication. Connecting, replacing and removing a key asks for your two-factor code, so a stolen password alone cannot change your keys.
• Bot-only account. For live trading you confirm that the account is used by your bots only. A dedicated sub-account works well.

Algonney never touches orders or positions it did not place. Anything else on the account is shown as not managed, so you still see the full picture.

How your keys are stored

Keys are encrypted at rest with XChaCha20-Poly1305 using envelope encryption: each user has their own data key, and that data key is itself encrypted by the platform's master key. The master key is a file kept outside the database and the code, readable only by the server's administrator account. A copy of the database on its own is therefore not enough to read any key.

A saved key is never shown again. The app shows only its last characters, so you can tell your keys apart. On OKX the passphrase is stored the same way as the key and the secret.

Checks after you connect

A key that worked yesterday can be changed or deleted on the exchange today. Keys are checked again on a regular schedule, and at once when an exchange refuses a call because of the key. If a key no longer passes, trading on that account stops, the connection is marked in Settings › Connections and you get a notice. Every open position keeps the stop loss that was already placed on the exchange, and you can replace the key without losing your bots or their history.

Create a safe key, step by step

Before you start, turn on two-factor authentication in your Algonney account and on the exchange. Then open Settings › Connections in the app, choose the exchange and copy the IP address the form shows.

Binance

1. Open API Management in your Binance account and create a new key. A system-generated key (HMAC) gives you an API key and a secret key. A self-generated key (Ed25519) needs its public key registered on Binance; you then paste the API key and the private key.
2. Turn on Enable Reading and Enable Spot & Margin Trading, plus Enable Futures if you want to trade USDT perpetuals.
3. Leave withdrawals, universal transfer and margin loan, repay and transfer off.
4. Restrict access to trusted IPs only and enter the address from the connect form.
5. Paste the key and its secret in Algonney. More on the Binance page.

Bybit

1. Open API management in your Bybit account and create a new system-generated key for API transactions.
2. Give it read and write access with trade permissions for the markets you want: spot, USDT perpetuals or both.
3. Leave withdrawal and asset transfer permissions off.
4. Choose the option that allows access only from listed IP addresses and enter the address from the connect form.
5. Paste the key and its secret in Algonney. More on the Bybit page.

OKX

1. Open the API page of your OKX account and create a new API key.
2. Choose a passphrase. OKX asks for it with every request, so Algonney needs it too.
3. Give the key Read and Trade permissions only. Leave Withdraw off.
4. Bind the key to the IP address from the connect form.
5. Paste the key, the secret and the passphrase in Algonney. More on the OKX page.

The full connect guide for each exchange is in the docs: Exchange connections.

Protect the rest of your account

A trade-only key limits what a leaked key can do, but your accounts still need care:

• Use a unique password and two-factor codes on both the exchange and Algonney, and keep your backup codes offline.
• Review your active sessions in Settings and sign out the ones you do not recognise.
• Never paste keys, seed phrases or passwords into a chat. Algonney removes such secrets from chat and support text before it reaches the AI or is stored, but the safest secret is one you never type.
• Delete keys you no longer use, on the exchange first and then in Settings › Connections.

Account security in the docs covers two-factor setup, sessions and sign-in alerts.

Related pages

• Security of your account and exchange keys
• Live trading
• Crypto risk management
• Plans and pricing

A trade-only key protects your funds from withdrawal, not from trading losses. Read the risk disclosure before you trade live.

Past results do not guarantee future returns.