An API key is a spare key handed to a program. The program calls the exchange with it and never types your password or passes two-factor, so what the key is permitted to do was settled entirely by the boxes you ticked at the moment you created it.
Three layers, under four sets of names
Each platform slices the permissions a little differently, but the slices fall into three layers. OKX labels them most plainly, so take those as the reference points:
- Read — view account information: bills, order history, balances.
- Trade — place and cancel orders, transfer funds, change any setting that needs write access.
- Withdraw — initiate a withdrawal.
The middle layer deserves a second look. OKX files funds transfer under Trade, so a key carrying trade permission and nothing else can still shuffle money between your own accounts. Nothing leaves your account that way, but “trade only” covers more ground than placing orders.
Kraken goes finer. Funds splits into Query Funds, Deposit Funds and Withdraw Funds; orders split into querying open orders, querying closed orders, modifying orders and cancelling them; separate boxes again for ledger queries, data export and WebSocket access. Granularity earns its keep when a tax tool wants nothing beyond an export of filled trades, because it can be handed that single box.
The four rule sets, side by side
| Platform | How permissions divide | With no IP restriction | Other limits available |
|---|---|---|---|
| Binance | Reading by default; trade, withdrawal and the rest are ticked on separately | A system-generated (HMAC) key can hold Reading and nothing else | Withdrawal permission requires an IPv4 access restriction first |
| OKX | Three boxes: Read, Trade, Withdraw | A key with trade or withdraw permission lapses after 14 days of no use | Up to 20 addresses per key; IPv4, IPv6 and ranges accepted |
| Bybit | Not itemised here; the boxes are listed on the key-creation page | A key created without an IP binding expires after 90 days | Re-selecting “no IP restriction” on the management page extends it 90 days from that date |
| Kraken | Ten individual boxes across three groups: funds, orders, other | The IP whitelist is optional | Key expiry date; a limit on how far back queries may reach; API withdrawals go only to addresses already saved in the account |
The Binance row is the easy one to get stuck on. You follow a third-party tool's setup guide, go to tick the trade box, find that the box refuses to stay ticked, and conclude something has gone wrong with the account. The explanation sits in the first entry of Binance's own API FAQ — “Why am I unable to enable any permission other than Reading?” — and the answer given is that no IP access restriction has been set. Binance dates the rule to 30 January 2023.
Why the IP restriction carries so much weight
Keys leak in unremarkable ways. A screenshot goes into a group chat with the string unblurred. Code reaches a public repository with the credentials still sitting in it. A third-party service loses its own database.
An unrestricted key works from anywhere, for anyone holding a copy. A restricted one works only from the address you named, which leaves a stolen copy inert. The four platforms answer the same risk four different ways: Binance withholds the permissions outright, OKX and Bybit start an expiry clock, Kraken leaves the decision with you.
Two things the restriction will not cover. If the machine you whitelisted is itself the machine that gets compromised, the whitelist protects nothing at all. And home broadband hands out an exit address that moves around, which makes a stable binding awkward for anyone running a script from a laptop.
Ask first
Suppose this tool were taken over whole. What could the key in its hands accomplish? When the answer runs past what you would be willing to absorb, untick something.
How far to open it, by what the tool is for
Accounting, tax filing, portfolio dashboards. Read alone. These tools want fills and balances, and order permission serves them no purpose. On Binance a key with no IP restriction is confined to Reading anyway, which happens to line up.
A strategy you run on your own machine. Read plus trade, bound to the address of the machine running it, withdrawal left off. A strategy that misbehaves loses money in the market, while the balance stays inside your account.
A hosted bot service. It runs on somebody else's machine, so the only address available to whitelist is theirs, and the security of that machine sits outside your control. A hosted service that asks for withdrawal permission has told you enough to walk away: executing orders never calls for it.
The uncommon case that genuinely needs API withdrawals — sweeping balances into one place automatically, say. Bind the IP, then also switch on the withdrawal address whitelist in the account itself, so the key can send funds to no destination except the ones you listed. Where that whitelist helps and where it stops short is covered in the security controls comparison. Kraken's API withdrawals already accept nothing but addresses pre-registered in the account, so the same protection arrives switched on.
After the key exists
A key outlives the tool it was made for. The OKX fourteen days and the Bybit ninety apply to unrestricted keys only; bind an address and the key will generally stay valid until you delete it by hand.
Least effort over time: whenever you retire a tool, open the API management page in the same sitting and delete its key. Disconnecting inside the tool stops that tool from calling and leaves the credential alive. Kraken lets you set an expiry at creation, which suits a one-off export job — the key lapses without further attention.
Name each key after its job: tax-export-read-only beats key3. Open the management page a year from now to five entries called key1 through key5 and nothing on screen will tell you which one is safe to remove.
With the account-level settings in place, the security settings checklist runs through which threats remain uncovered.
How this was checked
The Binance rules were read in 2026-10, the other three in 2026-09, from the pages below. Platforms revise them without notice, so the options actually shown on the creation page outrank anything written here.
- Binance: How to Create API Keys on Binance (read 2026-10; the page states it was last updated 20 March 2025)
- OKX: OKX API v5 documentation, the API key creation section (read 2026-09)
- Bybit: Bybit API documentation, FAQ (read 2026-09)
- Kraken: How to create an API key; the Withdraw Funds endpoint reference (both read 2026-09)
Found a line that has gone stale? Tell us, and the change will be logged in the corrections record.