An API key is the credential a centralized exchange issues so that an external program — a trading bot, a portfolio tracker, a tax tool, or our service — can interact with your exchange account without using your username and password. Every major exchange (Binance, Bybit, OKX, Coinbase, Kraken) implements API keys with the same conceptual building blocks: an immutable identifier (the key), a secret (used to sign requests), and a permission set that scopes what the key can do.
The three permission scopes that matter
Almost every halal-aligned and security-conscious bot integration depends on getting the permission scope right. The three standard buckets are:
- Read — the program can see balances, orders, and trade history but cannot move funds or place orders. Read-only is appropriate for portfolio trackers and tax tools.
- Spot trade — the program can place spot buy and sell orders, cancel them, and read the resulting fills. It cannot withdraw funds. This is the permission scope our bot uses.
- Withdraw — the program can move funds off the exchange to an external address. We never request this and you should never grant it to any third-party service unless you specifically need automated withdrawals (e.g., a treasury workflow), and only with strict address whitelisting.
A correctly configured key for our bot has read enabled, spot-trade enabled, and withdraw explicitly disabled. Most exchanges default withdraw to off, but it is the user's responsibility to verify before sharing the key.
How the signature mechanism works
When the bot makes a request, it builds the request payload, hashes it together with a timestamp using HMAC-SHA256 keyed by the API secret, and sends the resulting signature in the request headers. The exchange recomputes the same hash on its side and compares. This means the secret never leaves the bot's environment after key creation — the secret is only used to derive signatures, not transmitted on each call. If the secret leaks, the consequence is that an attacker can impersonate the bot until you delete the key. They cannot, however, log into your exchange account — the API key is a separate credential to the human-login credential pair.
Operational best practices
The OWASP API Security Top 10 and NIST 800-63B guidance translate cleanly to retail crypto:
- Disable withdraw. Always. There is essentially no scenario where a third-party trading service needs withdraw permission.
- Restrict by IP allowlist if your service supports it (we do; we publish a static IP set you paste into the exchange's allowlist). This means even if the secret leaks, the attacker cannot use it from their own infrastructure.
- Rotate keys quarterly. Treat them like passwords: a long-lived credential is a bigger target.
- One key per integration. Don't reuse the same key across multiple bots, trackers, or scripts. Revoking a key revokes everything that depended on it; one-key-per-integration limits the blast radius.
- Store the secret in a password manager, never in plaintext, never in a chat message or email, and never in a git repo.
Halal relevance
API keys are a structural enabler of spot-only execution on a centralized exchange without ever giving the bot custody. Because the withdraw scope is disabled, the bot cannot move tokens off the venue — it can only buy and sell within your account. This matters for the halal evaluation because (a) the user remains the legal beneficial owner at the exchange custodian throughout, (b) the bot has no ability to introduce a leverage or margin product the user did not opt into, and (c) every action the bot takes is auditable from the exchange's own trade history.
If a bot or service ever asks for withdraw permission "to operate", treat that as a serious red flag. The legitimate trading-bot use case does not require it.
What happens if a key is compromised
If you suspect a key has leaked, the recovery procedure is the same on every major exchange: log into the exchange directly (not through any link in an email), navigate to the API management section, delete the suspect key, generate a new one, paste it back into the bot, and verify the bot reconnects. Because withdraw was disabled, the worst case from a leaked key is that the attacker placed nuisance orders against your spot balance — annoying, but not a path to drained funds.
Key takeaway
API keys are the mechanism that lets an automated service interact with your exchange account without taking custody. The single most important configuration choice is keeping withdraw permission off. Combined with IP allowlisting, quarterly rotation, and one-key-per-integration discipline, API keys are a sound mechanism for running a halal-aligned trading bot against a centralized exchange.
Disclaimer: This is not financial, legal, or religious advice. Consult a licensed professional and a qualified scholar for your jurisdiction. See /risk-disclosure and /terms for the current risk and service-scope terms.