API Key Permissions

An API key is the credential a program uses to reach a trading account without a password, and its permissions decide what that program is able to do. Well-designed access is granular: read-only keys that can pull balances, positions and history but cannot trade; trading keys that can open and close positions; and, kept separate from both, any ability to move money — which should not be attached to a trading key at all. The rules are the ones that apply to any credential that can spend. Issue a separate key per application so one can be revoked without breaking the others, grant the narrowest permission the task needs, restrict the key to the addresses it will be used from where the platform allows it, and rotate keys on a schedule and immediately after any machine that held one is retired. A key pasted into a third-party dashboard, a spreadsheet or a chat window is a live credential sitting in someone else's custody.