Why Trade-Only API Keys Matter (and How to Set Them Up)

When you connect any automation tool to your exchange, the single most important safety decision is what its API key is allowed to do. A trade-only API key can place and cancel orders but cannot move your money — and that one restriction is the difference between a bounded inconvenience and a drained account if a key is ever exposed. This guide explains why trade-only keys matter and walks through how to set one up correctly.

We will not recommend a strategy or promise any result. The aim is to help you connect automation in the safest way your exchange supports.

What an API key actually grants

An exchange API key is a credential that lets external software act on your account. Crucially, exchanges let you scope each key independently across three kinds of permission:

• Read: view balances, positions, and order history.
• Trade: place and cancel orders against your existing balance.
• Withdraw: move funds off the exchange to another address.

The exchange itself enforces these limits — not the software holding the key. That is the property a trade-only setup relies on: if you never grant withdrawal permission, no tool, however buggy or compromised, can withdraw your funds.

Why trade-only is the right scope for automation

An execution layer has exactly one job: turn your signals into orders. It needs trade permission, usually read permission, and nothing else. There is no legitimate reason for it to hold withdrawal rights.

Scoping to trade-only keys means the tool places orders, never withdrawals. If a key leaks — through a breach, a logging mistake, or a phishing attack — the worst case is unwanted orders on your own account: visible, bounded by your balance, and reversible by closing positions and revoking the key. Compare that to a key with withdrawal rights, where the worst case is funds gone for good. The asymmetry is the whole argument. This is also why non-custodial execution and trade-only keys go together: your funds stay on your exchange, and the connection can only trade. We unpack that pairing in our guide on custodial vs non-custodial trading bots.

How to set up a trade-only key

The exact menu names vary by exchange, but the steps are the same everywhere. Always create a dedicated key for each tool rather than reusing one.

1. Open API management

Log in to your exchange and find the API section — usually under Account, Profile, or Settings, labeled "API Management" or "API Keys."

2. Create a new key

Generate a new key and give it a clear label like "signaltoexchange-trade" so you can identify and revoke it later. The exchange will show an API key and a secret; the secret is shown once, so copy it carefully.

3. Enable trade, leave withdrawal OFF

In the permissions list, enable reading and spot and/or futures trading as appropriate for what you trade. Leave the withdrawal permission explicitly disabled. On Binance this means enabling "Enable Spot & Margin Trading" and/or "Enable Futures" while leaving "Enable Withdrawals" unchecked. On Bybit, select the "Trade" permission and do not grant "Withdraw." The labels differ; the principle does not.

4. Restrict by IP if you can

If the exchange offers IP allow-listing, restrict the key to the addresses your automation tool publishes. This means a leaked key is useless from anywhere else. If the tool provides its outbound IPs, add them here.

5. Connect and confirm

Paste the key and secret into the tool. A well-built execution layer will accept a trade-only key without complaint, because it does not need more. If a tool refuses to work unless you grant withdrawal access, treat that as a red flag and stop.

Best practices for key safety

• One key per tool so you can revoke access for one service without disrupting others.
• Never grant withdrawal permission to an execution or signal tool.
• Use IP allow-listing whenever the exchange supports it.
• Store keys encrypted at rest — confirm the tool uses encryption such as KMS-backed envelope encryption rather than plain text.
• Rotate periodically and immediately if you suspect exposure.
• Keep your kill switch ready: you can delete the key in your exchange dashboard at any time to cut off access instantly.

How SignalToExchange uses your key

SignalToExchange is non-custodial execution infrastructure: it takes a structured signal from TradingView, a bot, or any webhook source, validates it against your rules, and routes it to your exchange as a correctly formatted order. It connects with trade-only keys, stores them encrypted at rest, and never requests or needs withdrawal permission — your funds never leave your exchange, and one signal fires exactly one order. For a deeper look at API key safety, see our guide on whether it's safe to give a trading bot your API keys.

If you want a secure way to automate your existing signals with trade-only access, Request access / start your free trial →

Automated trading involves risk. SignalToExchange is execution infrastructure and does not provide financial advice, trading signals, or guarantees of any kind.