# Binance API Keys: Use Them Safely

Quick answer

Binance API keys are credentials that let third-party apps read your balance or place trades without your password. Withdrawals should never be enabled on any key, and every key should be IP-restricted and rotated. Set one up correctly in about 10 minutes, then audit it every 90 days.

API keys are the single most over-trusted feature in retail crypto trading. Most people create one to connect a portfolio tracker, forget it exists, and discover two years later that it is still sitting in a config file with trading permissions wide open. This guide is about the security model around Binance API keys — what each permission actually unlocks, how attackers go after them, and what to do in the first ten minutes after you suspect a leak.

For the account-level picture, start with Is Binance Safe?, then come back here for the developer surface.

Some links on this page are affiliate links. If you sign up through them we may earn a commission at no extra cost to you. Placement never changes a score. Offers, bonus amounts and expiry dates are verified daily but can change without notice — always read the official terms. Crypto assets are volatile and nothing here is financial advice.

What Binance API keys actually are

An API key is a pair of strings: a public key (the API key itself, which identifies you) and a secret key (which proves you are you). When an application signs a request with the secret, Binance treats that request as if you made it from the website. There is no second confirmation step, no pop-up, no email — unless you explicitly configure one.

That design is what makes automated trading possible, and it is also what makes the keys dangerous. A leaked password can often be neutralised by 2FA. A leaked API secret cannot, because the whole purpose of the secret is to bypass interactive login.

Three categories of tools ask for keys:

• Read-only tools. Portfolio trackers, tax calculators, and P2P accounting apps. They need to list balances and pull trade history. Nothing more.
• Trading tools. Grid bots, DCA bots, rebalancers, copy-trading clients, and custom scripts. They need to place and cancel orders.
• Everything tools. Almost nothing legitimate belongs here. No genuine third-party app needs to move your coins off the exchange.

The full technical reference lives at developers.binance.com, and Binance’s help centre mirrors the same permission definitions. Its global operation, proof-of-reserves, and SAFU disclosures do nothing to protect a key you handed to a phishing page yourself.

If you want the commercial side of the platform — fees, tiers, earned products — our Binance review page covers that in depth.

The one permission you must never grant

Enable Withdrawals. There is no configuration in which this is the right answer for a third-party application. Enabling it converts a trading-bot compromise into an irreversible drain: the attacker does not need your password, your 2FA device, or your withdrawal address allowlist — the API endpoint does the transfer directly.

Some bots ask for it “for convenience” or claim they need it to “auto-compound.” They do not. Auto-compounding is done through spot trades or Earn subscription flows, not withdrawals. Decline every time.

Permissions table: what each setting unlocks

Read that table as a hierarchy, not a menu. Every step up increases the blast radius if something goes wrong. Most users only ever need row one.

How to create a locked-down key

The flow is stable across Binance’s web interface, though labels shift slightly with redesigns. Go to Account → API Management (sometimes listed under “API Keys” in profile settings).

Step 1 — Label it for its purpose. Use something specific like tracker-readonly-macbook rather than my key. When you audit in six months, you will need to know what each key does, and “my key” tells you nothing.

Step 2 — Choose permissions before you generate. Pick Enable Reading if the tool only reads, add trading only if it genuinely trades, and leave withdrawals unchecked. Starting minimal is what keeps damage small.

Step 3 — Set IP restriction. Paste the public IPv4 of the machine making requests. Consumer ISPs rotate home addresses, so those keys eventually break; use the static IP your VPS provider assigns instead.

Step 4 — Store the secret properly. You see it exactly once, at creation. Copy it into a password manager. Do not:

• Commit it to a Git repository, even a private one. Bots scan GitHub within seconds of a push.
• Paste it into a .env file that gets zipped and emailed.
• Store it in a note-taking app that syncs unencrypted.
• Send it to yourself over chat, including “temporarily.”
• Put it in a screenshot or a screen recording.

Step 5 — Test with the smallest possible action. Run a trading bot with a deliberately tiny order size first, so the downside stays capped at a few cents.

If you are connecting a bot for the first time, our Binance tutorial walks through account setup, deposits, and the first trades on the standard interface.

Recognizing phishing and fake “API verification” scams

Attacker playbooks around Binance API keys are consistent enough to learn by pattern.

Cloned exchange sites

The most common vector is a look-alike domain promoted through search ads, Telegram DMs, or YouTube descriptions. You enter your real credentials — often your 2FA code too — which the proxy forwards to the genuine site in real time. Defences: never follow a DM link, bookmark the official domain, and check the certificate before typing anything.

The “API verification” scam

A fake support agent contacts you on Telegram and says your account needs “API verification” to keep withdrawals working, then asks you to create a key and paste the secret into a form. There is no such procedure, and Binance support will never ask for your API secret, password, or 2FA codes. The secret is functionally a password that never expires.

Malicious trading bots

A bot distributed as free software, a browser extension, or a Docker image may work exactly as advertised while exfiltrating your keys. Risks concentrate in:

• Forks of well-known open-source bots with a “minor fix” added
• Browser extensions that request broad site access
• Docker images from unofficial registries
• Any tool that asks for withdrawal permissions

Mitigations are boring but effective: use tools with active issue trackers, verify repository ownership, and run unfamiliar bots on a dedicated sub-account with a small balance.

The leaked-config vector

Not every compromise involves an attacker. Developers publish .env files inside Docker images, paste configs into public support threads while debugging, or commit secret-bearing state. If you ever shared a key while debugging, treat it as burned.

If a key leaks: the first ten minutes

Speed matters more than forensics. Do these in order.

1. Delete the key immediately. Account → API Management → Delete. Do not wait for confirmation of misuse. A deleted key stops all future requests instantly.

2. Check for unauthorized orders and fills. Review open orders, trade history, and futures positions. Attackers often wash-trade against themselves or use your account as exit liquidity. Cancel anything you did not create.

3. Check withdrawals and internal transfers. Even without withdrawal permission on the leaked key, verify nothing else was compromised. Look at withdrawal history, internal transfer history, P2P history, and any linked sub-accounts.

4. Disable anything else that looks wrong. Check authorised devices, active sessions, and any recently added withdrawal addresses.

5. Change your password and reset 2FA. If a cloned site took your credentials, assume the password is gone. Change it from a clean device and re-enrol 2FA rather than reusing your old seed.

6. Contact support with timestamps. Give them the key label, creation date, and the window of suspected exposure. Requested logs are easier to pull while fresh.

7. Post-incident, rebuild. Create a new key with a new label and a revised IP list, then update your tooling from the password manager rather than recreating the old setup from memory.

Complementary protections worth enabling

API keys are not your only layer, and the strongest setups combine them.

• 2FA via an authenticator app. Use TOTP (or a hardware key where supported) rather than SMS, which is vulnerable to SIM swap. This protects web login, not the API itself — hence treating the two separately.
• Withdrawal address allowlist. Restrict withdrawals to addresses on a pre-approved list. Changes typically trigger a time lock and an email confirmation, so an attacker cannot redirect funds instantly.
• Anti-phishing code. Configure a code that appears in every legitimate email from the exchange. If a message lacks it, the message is fake.
• Device management. Review authorised devices periodically and log out stale sessions, including that old phone you sold.
• Sub-accounts. If you run several bots, isolate each one in a sub-account with only the capital it needs. One bad bot cannot then drain your main balance.

You can compare how this stack lines up against the alternatives on our top crypto exchanges page.

A practical security checklist

Run this quarterly. It takes fifteen minutes and catches nearly everything.

• [ ] No key has withdrawal permission enabled
• [ ] Every key is IP-restricted to specific addresses you control
• [ ] Keys are labelled by purpose, and every label is still recognisable
• [ ] Any key unused in the last 60 days has been deleted
• [ ] No key older than 180 days is still active — rotate it
• [ ] Secrets live only in a password manager, never in the repo or the shell history
• [ ] No key was ever shared in a support thread, chat, or screenshot
• [ ] Bots run on sub-accounts with capped capital
• [ ] Authenticator-based 2FA is active and SMS is removed where possible
• [ ] Withdrawal address allowlist is enabled
• [ ] Anti-phishing code is set and visible in recent emails
• [ ] Two factor seed backup is stored offline

Rotation interval: how often is enough

Rotation is a trade-off: too frequent and you break production bots and take shortcuts; too rare and a leaked key stays valid indefinitely. For personal use, every 90 days is sensible. Production deployments should rotate on any personnel change.

Rotation also has a diagnostic benefit: delete an old key and see if anything breaks — you will discover orphaned credentials you forgot existed, exactly the kind that eventually become a problem.

Where the costs fit in

Security mistakes are far more expensive than fees, so comparison shopping belongs below hygiene on your priority list. Once Binance API keys are locked down, though, it is worth understanding what automated trading costs you.

Spot fees start at 0.10% maker and 0.10% taker at base VIP 0 (verified October 2026). Higher VIP tiers step down toward roughly 0.02% maker and 0.04% taker, and enabling BNB fee deduction takes approximately 25% off spot fees. High-frequency bots are precisely the workload that benefits from those reductions — a grid bot running thousands of fills a month converts a 0.10% taker rate into meaningful drag.

New users can get 14 days of 0% spot fees plus a reward of up to 400 USDC through the referral programme. KYC is required, and that verification also unlocks higher API rate limits.

Frequently asked questions

Are Binance API keys safe to use?

They are safe when scoped correctly and dangerous when over-permissioned. A read-only, IP-restricted key stored in a password manager carries minimal risk. Enable trades only for bots you run, restrict IP addresses always, and never enable withdrawals on any key under any circumstances.

Should I enable withdrawals on an API key?

No. No legitimate third-party application requires withdrawal permission to function. Portfolio trackers read balances, trading bots place orders, and tax tools pull history — none move funds off the exchange. Withdrawal permission converts a bot compromise into permanent, irreversible loss of funds.

What happens if someone steals my Binance API secret?

They can do whatever the key’s permissions allow until you delete it. With read-only access they see your balances and full trading history. With trading access they can place and cancel orders. Immediately delete the key, review order and withdrawal history, then change your password and reset 2FA.

How do I restrict a Binance API key to one IP address?

Open API Management, create or edit the key, and choose the IP-restricted option. Paste the public IPv4 address of the server or machine making requests. Requests from any other address will be rejected. Consumer internet connections rotate addresses periodically, so plan to update the restriction when yours changes.

Do I need separate API keys for each application?

Yes. Separate keys mean separate blast radii and separate audit trails. If one tool is compromised, you delete one key without disrupting anything else. Naming each key after its purpose also makes your quarterly audit dramatically faster, since you immediately know what each credential does.

Can a read-only API key be used to withdraw my funds?

No. A key with only Enable Reading permission cannot place orders, transfer funds, or withdraw anything. This is exactly why every portfolio tracker, tax tool, and balance viewer should use read-only credentials. Always verify which permissions a tool requests before entering your secret anywhere.

How often should I rotate my API keys?

Every 90 days works well for personal setups, and immediately after any suspected exposure, personnel change, or device loss. Rotation also surfaces orphaned keys — delete one and watch which bot breaks to discover credentials you forgot existed. Long-lived keys tend to drift toward over-permission over time.

Where do I find the official Binance API documentation?

The official reference is at developers.binance.com, which covers REST and WebSocket endpoints, request signing, rate limits, and error codes. Binance’s help centre mirrors the same API creation steps. Avoid third-party tutorials that link to unfamiliar domains asking you to paste your secret key.

Closing

Most losses involving Binance API keys trace back to three decisions: enabling withdrawals that were never needed, skipping IP restriction, or leaving a five-year-old key active for a bot you stopped running. None of those are sophisticated failures — they are configuration shortcuts, and every one is preventable with fifteen minutes of maintenance a quarter.

Set up your key with minimum permissions and an IP allowlist, store the secret in a password manager, and put a recurring reminder on your calendar to audit and rotate. For the full platform picture — including the new-user offer of 14 days at 0% spot fees plus up to 400 USDC — see our Binance exchange overview. Alternatives are compared on our top exchanges page.

This is not financial advice. Fees and offers verified October 2026.