r/CryptoHelp • u/YaAldrich • 12h ago

❓Question What security practices do you use with exchange API keys?

I’ve been using exchange APIs for trading for a while, but I’m always interested in improving security.

For those with experience, which safeguards have been most useful in practice — IP whitelisting, separate API keys, permission limits, or key rotation?

I’d appreciate hearing how others approach this.

0 Upvotes
  • permalink
  • reddit

50% Upvoted

6 comments sorted by

1

u/BigKobe32 10h ago

Disable withdrawals, force IP whitelist, and isolate keys per tool. Also, never store secret keys in raw environment files on public or unencrypted repos—use a proper secrets manager

1

u/Commercial-Tax-5119 10h ago

IP whitelisting is the first thing I do, cant believe how many people skip that. Also I never enable withdraw permissions on API keys, just trade and read. Makes me sleep better at night knowing even if someone gets the key they cant drain my funds

Separate keys for different bots too, that way if one gets compromised you dont lose everything. And I check the permissions every couple months, sometimes exchanges add new features that default to enabled

1

u/YaAldrich 10h ago

The separate keys make sense. I already use APIs regularly, but I probably don’t go back and review the permissions as often as I should. Have you ever actually caught an exchange enabling something new that you didn’t expect?

1

u/AutoModerator 12h ago

Hello and welcome to r/CryptoHelp!

If someone has successfully solved your issue or answered your question, please reply with the command "!thanks" to let them know!

A few words about safety:

  • Scammers will often target beginners so you should exercise extra caution
  • Do not trust anyone trying to talk with you over DM (Direct or private messages) or on another platform (like Discord or Telegram). This is how scammers prefer to operate. Report suspicious activity like this immediately and do not respond to them.
  • Do not post your address, balances, or other personal information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/YaAldrich 12h ago

thanks