API Keys: Trade Access Only
🔐 A trading bot does not need withdrawal access.
It only needs trading access: read balance, read positions, place orders, manage orders.
No withdrawal rights
⚙️ API keys for bots should be created strictly without withdrawal permissions. A bot should not be able to move funds out of the exchange.
Transfers should also stay disabled unless you clearly understand why they are needed.
Separate keys
📍 Do not use one API key for everything.
One bot — one key. One strategy — one controlled access point.
If something goes wrong, you disable one key instead of rebuilding the whole setup.
For larger balances, subaccounts are cleaner. Keep the main funds separate and give the bot only the capital it needs to trade.
IP whitelist
🧱 If the exchange allows IP restrictions, use them.
The key should work only from the server where the bot is running. Even if the key leaks, the attack surface is smaller.
Crypto Resources workflow
In Crypto Resources, the normal setup is simple: trade-only API key, no withdrawal rights, limited permissions, IP whitelist when possible, controlled capital, then bot connection.
Spot Bot and ST-Bot are execution tools.
Security starts before the first trade.
No withdrawal rights.
Limited access.
Separate keys.
Controlled capital.
#API #SecurityFirst