Exchange API key

Exchanges let users create API keys, usually a public key plus a secret, from their account settings. Each key carries permissions: read-only access to balances and history, trading rights, and on some platforms withdrawal rights. Tax software and portfolio trackers need only read access, while trading bots need permission to place orders.

API access is how most automation in centralized crypto trading works, from simple DCA bots to institutional systems. Good practice is to grant the minimum permission needed, never enable withdrawals for third-party tools, restrict each key to specific IP addresses where the exchange allows it and delete keys that are no longer used.

Leaked keys are a known attack route. Criminals who obtain a trading-enabled key have drained accounts without withdrawals by using them to buy illiquid tokens at inflated prices from accounts they control. Keys stored in malicious browser extensions, shared spreadsheets or fake bot services are frequent sources of such leaks.