Is it safe to give a bot an API key

What an API key is

A pair — key and secret — that an exchange issues for software. A key carries a set of permissions: read the balance, trade, withdraw. Which ones are on is your choice, made on the exchange when you create the key.

What a key without withdrawal can do

• See your balance and order history.
• Place and cancel orders on the spot market.
• It cannot withdraw funds to an outside address: it has no such permission.

What it still puts at risk

A trading key in the wrong hands cannot withdraw, but it can trade in your name — buy an illiquid coin at a bad price, for instance. That is why a key is bound to the server’s IP address: from any other address the exchange refuses it, even if it leaked.

How Nexora handles it

• A key that may withdraw is refused when you connect it — even if you try to add one.
• Exchange keys are stored encrypted only.
• A key can be connected only with two-factor authentication on.
• The server address to bind to is shown in the app, on the Exchanges screen.
• Your funds stay in your exchange account at all times: Nexora takes no deposits.

What to do yourself

• Create a separate key for Nexora and use it nowhere else.
• Turn on reading and spot trading only. A bot needs no withdrawal, transfers, futures or margin.
• Bind the key to the server’s IP address.
• Stopped using it? Delete the key on the exchange: that switches it off at once.
• Send the key’s secret to no one. We never ask for it.