API key safety

The golden rule

Your API key must be able to trade – and nothing else. Never enable withdrawal. Then nobody, not even we, can move money out of your account.

Bybit

1. Bybit – profile – API – create a new key (System-generated).
2. Permissions: Read-Write, and only Contract – Trade. Leave Withdrawal and Transfer off.
3. Add an IP whitelist if your exchange supports it – the engine IP is shown on the connect step.

OKX

1. OKX – profile – API – create a V5 API key.
2. Permission: Trade only. Never Withdraw.
3. Save the passphrase – you need it when you connect.

Good habits

• Use one key per service. Do not reuse your trading key anywhere else.
• Never paste your key into chat, email or a support message.
• If a key leaks: delete it on the exchange right away and create a new one.

If you ever need to stop everything, delete the API key on the exchange – the connection dies instantly.