What is API key?

A credential that lets a program trade or read data on your exchange account without your password.

Keys carry permissions, and a key with withdrawal rights is as dangerous as the account itself. Grant read-only access where that is enough, restrict keys to specific addresses on the internet, and delete keys you no longer use.

Most buyers create one without realizing what they have done, usually to connect a portfolio tracker or a tax tool. The key is a standing credential that keeps working after you close the app, forget the service, or stop paying for it, and it does not require your password or your second factor to be used.

How it works

An exchange issues a key pair: a public key identifier and a secret. The secret is shown once and never again, because the exchange stores only a hash of it.

Your program signs each request. It builds the request, computes a keyed hash of it using the secret, and sends that signature in a header alongside the key identifier. The exchange recomputes the signature and rejects anything that does not match, so the secret itself never travels over the network.

Requests include a timestamp and often a receive window, so a captured request cannot be replayed later. Requests that change state also carry a nonce for the same reason.

Keys are scoped. Read, trade, and withdraw are separate rights, and most venues also let you restrict a key to a list of internet addresses. Some scope a key to one sub account, which caps what a leak can reach.

Rate limits attach to the key rather than the account, which is why a badly written bot can lock out your other tools.

Example

Illustrative: you connect a tax tool in January with read-only access, cancel the subscription in June, and forget the key. In November the tool's provider is breached and its stored keys leak. Because your key is read-only and locked to the provider's server addresses, the attacker gets your trade history and nothing else. Had you granted withdrawal rights, the same leak would have been the account. The difference was one checkbox at creation.

Why it matters when you buy

If you use anything beyond the exchange's own app, a portfolio tracker, a tax importer, a recurring-buy script, you are creating credentials that outlive your attention. Grant the least a tool needs, prefer venues that let you bind a key to an address, and audit the list twice a year. See the guide on two-factor authentication for the surrounding account hygiene, and the exchange directory for which venues offer what.

Related terms

• api key permissions — the rights you attach to a key
• withdrawal whitelist — limits where a key can send funds
• two factor authentication — protects login, not key use
• sub account — scoping a key to part of a balance
• totp — the code type usually required to create a key
• phishing — the usual route by which secrets leak

Questions

Can someone with my API key log in to my account?

No. A key works only through the exchange's programming interface, and it cannot change your password, email, or security settings. What it can do depends entirely on the permissions you granted.

Do API keys expire?

Some venues expire keys automatically after a set period of inactivity, and others leave them live indefinitely. Do not rely on expiry; delete keys yourself when you stop using a tool.

Is a read-only key really safe?

Safe from theft of funds, yes. It still exposes your full balance and trade history, which is worth protecting for privacy reasons and because that data helps target a person for a scam.