How to Set Up a Binance API Key Safely

Create a system-generated API key on Binance without adding an IP restriction, and reading is the only permission it can have. That default comes from Binance's Help Center article How to Create API Keys on Binance? The platform has closed off half of the most dangerous setup already. The other half is yours to configure: which permissions to switch on, whose IP to enter, and whether the money sits in the master account or a sub-account.

Binance's own bots vs third-party bots: which needs an API key

Two kinds of bot, two different worries:

Binance's own bots (grid, Spot DCA and the like) run inside Binance's own system, so there's no handing an API key to an outsider. The "safety" question here is mainly whether the strategy itself loses money, not whether your account gets stolen.
Third-party bots/platforms run outside Binance, and to operate your account they must get your API key. The account-security risk sits here, and this is the case the article covers.

So if you only use Binance's own grid and Spot DCA bots, no key leaves your hands and the key-leak risk does not apply; what you should worry about is whether the strategy makes or loses money (how each type of bot loses is covered in Binance Trading Bots: The 8 Types). The rest of this page applies when you hand a key to a third-party tool or call the API from your own program.

What an API key hands over

An API key isn't your login password, but it is a key that can operate your account within the permission scope you grant it. A system-generated key comes in two parts: the API key and the Secret Key. Once a third-party bot holds both, it can place orders and pull data on your behalf within the scope you authorized, with no login password needed; without withdrawal permission it cannot move coins out.

How dangerous an API key is depends on which permissions you turn on and which limits you add. The same key with only reading enabled lets the other side see your balance and positions, and nothing more; a key with withdrawal permission, once leaked, lets coins be sent straight out. So the question behind "is this bot safe" is whether the permissions and limits on this API key are set correctly.

Binance's API FAQ says the Secret Key is only visible when the API key is created and is masked afterwards; if you lose it you have to create a new key. Store it the moment it is generated, do not screenshot it into a chat, do not leave it where it can be stumbled on, and do not type it into a site or app you cannot vouch for. The same page says that entering your API key or Secret Key on any third-party platform carries a security risk.

How to create a Binance API key: prerequisites and the two key types

The Help Center lists three prerequisites: two-factor authentication (2FA) enabled on the account, a deposit of any amount to your Spot Wallet to activate the account, and identity verification completed. On the web, log in, click the profile icon and [Account], then go to [API Management] and click [Create API]. Creation is confirmed with your 2FA devices and passkeys.

The first step is choosing the key type, and that choice decides which permission rules apply afterwards:

System-generated: these keys use HMAC symmetric encryption, and you get two things, the API key and the Secret Key. This is the kind a third-party tool means when it asks for a key and a secret.
Self-generated: these keys use Ed25519 or RSA asymmetric encryption. You create the public-private key pair yourself and give Binance only the public key; the private key never passes through Binance's page.

What permissions a Binance API key has

The fields returned by the Get API Key Permission endpoint in Binance's developer documentation are the full set of switches on a key. Grouped by consequence:

Group	API field	What it controls	For a bot
Reading	enableReading	Viewing balances, positions and orders	Enough on its own for a dashboard, a stats script or a tax tool
Trading	enableSpotAndMarginTrading, enableMargin, enableFutures, enableVanillaOptions, enablePortfolioMarginTrading, enableFixApiTrade	Placing orders on spot and margin, futures, options, portfolio margin and the FIX API	Only the one market the tool actually trades
Transfers	enableInternalTransfer, permitsUniversalTransfer	Moving funds between accounts	Not needed to run a strategy; leave off
Withdrawals	enableWithdrawals	Sending coins to an external address	Leave off

A separate ipRestrict field records whether the key is bound to IP addresses. The labels on the creation page may be worded differently; go by what the API Management page shows. A trading bot's job is placing and cancelling orders. Moving coins out of the account is no part of it, and a third-party tool that asks for withdrawal permission has given you the reason to drop it.

What a key without an IP restriction can do, and how to restrict by IP

The Help Center puts it this way: "Unrestricted-IP-Access HMAC API Key(s) won’t have any permission other than reading." To enable other permissions you have to add IP access (IPv4 format) restrictions, use a self-generated key (Ed25519 or RSA), or disable the default security controls. Two more rules from the same page:

"Adding IP access (IPv4 format) restrictions is mandatory to enable withdrawal permission."
A key created before you enabled your Futures account, or on an account with Portfolio Margin activated, cannot enable Futures permission.

So for a system-generated key, the proper way to get trading permission is to bind an IP first. The third route, disabling the default security controls, means removing this protection yourself and is not one to take. Binance's own wording is that it strongly recommends against enabling anything other than reading on a key without appropriate IP access restrictions.

What goes in the IP list is the public IPv4 address of the machine that sends the requests: the fixed outbound IP a third-party platform publishes, or the fixed IP of your own server if you run the program yourself. A home broadband address changes and is a poor choice. Once bound, the key only accepts requests from those addresses, so a copy of the key is useless on someone else's machine.

Why a trade-only key can still be wash-traded

Switching withdrawals off closes one route: sending coins straight to an external address. A second route needs no withdrawal permission at all. Someone holding the key uses your account to place orders on a thinly traded pair at prices far from the market, and the counterparty is another account they control. Your account buys high and sells low, theirs does the opposite, and after a few fills the money has moved from you to them. On your side it looks like a string of trading losses. That is wash trading against your account. No withdrawal takes place at any point, so the withdrawal setting makes no difference to it.

An IP restriction stops one version of this: the key leaking to a machine that is not on the list. It does not stop the other: the compromised machine is the one on the list, for example the third-party platform's own server, and the requests come from an allowed address. No setting fully blocks that case. What you can do is lower the ceiling on the loss:

Enable trading only for the one market the tool uses. If it never touches futures, leave futures off.
Keep the money you hand to the bot apart from the rest; the sub-account section below shows how.
Go through the trade history from time to time, looking for orders you did not place, fills on obscure pairs and fills far from the market price.
When you stop using a tool, delete its key.

Using a sub-account API key to wall off the bot's money

A sub-account is a separate account under your master account, with its own funds and trade records. According to the Help Center article Binance Sub-Account Functions and Frequently Asked Questions:

The function is available to all Binance users who complete identity verification and enable 2FA. Regular users can create up to five sub-accounts; for VIP users the number depends on the VIP level.
Sub-account API keys are created and edited from the master account's [API Management] tab, up to 30 keys per sub-account.
Transfers between the master account and sub-accounts are instant and free, and only the master account can manage them.
VIP level and fee discounts are set by the combined trading volume of the master account and all sub-accounts.

In practice: open one sub-account for the strategy that will be connected to a third-party tool, transfer in only the money meant for that strategy, and create the API key under that sub-account. The key can then see and move only what is in the sub-account, so even the wash-trading case above is capped at the amount you transferred in. Whether to add more or pull it back is decided from the master account. With several strategies running, one sub-account each also keeps their results apart.

API key FAQ

I lost the Secret Key. Can I look it up again on Binance?

No. Binance says the Secret Key is only visible when the API key is created and is masked afterwards. Create a new key and delete the old one.

Why can't my API key enable Futures permission?

The Help Center gives two reasons: the key was created before you enabled your Futures account, or you have activated Portfolio Margin. In the first case, create a new key after the Futures account is open and try again.

My program suddenly gets HTTP 403. Has the key been banned?

It is not the key. According to the API FAQ, a 403 means a WAF (Web Application Firewall) rule was violated, typically by sending requests too often. The limit applies to the IP, the ban usually lasts five minutes, and fixing your code does not lift it early; you wait until it expires.

What to do if you think a key has leaked

If you suspect a key has leaked, or a third-party platform has run into trouble, work through this in order:

Delete that API key first. Remove it on Binance's API Management page. That is more direct than editing its permissions or its IP list.
Check the account for unusual activity. Look for orders you did not place and unfamiliar logins. With withdrawals off, coins cannot be withdrawn directly, but money can still be lost through abnormal fills: check obscure pairs, fills far from the market price and any order that is not yours.
Find the source before creating a new key. If a platform or an app is the problem, stop using it. Once the environment is clean, create a fresh key with the permissions and IP restriction described above.
Harden the account while you are there: change the password, confirm 2FA is still on and review the withdrawal address whitelist.

With withdrawals off and an IP bound, the one outcome that cannot happen is coins being withdrawn directly. Whether there was a loss at the trading level is what step 2 tells you. If the key lived in a sub-account, add one step: transfer whatever is left in that sub-account back to the master account.

How to Set Up a Binance API Key Safely, and Why a Trade-Only Key Can Still Be Drained