Before you plug a trading bot into your exchange: API key habits that limit damage

Trading bots, copy-trading tools and portfolio trackers are widely advertised, and many of them ask you to create an API key on your exchange account and paste it into their service. That key lets the software read your balances, place orders or, in the worst case, move funds, depending on the permissions you grant. Once you hand over a key, its safety depends on how carefully the service stores it and how narrowly you configured it. Users in the Philippines are frequently approached through social media and messaging groups by bot services promising steady returns, which makes careful habits especially important. This guide covers how to evaluate a service before connecting, how to create a narrow key on Binance, OKX, Bybit or Bitget, and how to monitor and retire keys afterwards.

Question the service before creating any key

Before creating a key, find out who operates the service, how long it has existed and how it stores keys. Be very cautious of any tool that promises guaranteed or fixed returns, asks you to deposit funds into its own wallet or requires withdrawal permission. A legitimate trading tool needs to place orders, not to move your assets elsewhere. If the only information comes from a messaging group or an influencer, treat that as a warning sign and keep researching or walk away.

Create a key with the narrowest permissions

When you create the key in your exchange account, enable only what the tool needs. A tracker needs read access. A trading bot needs read and trading access. Leave withdrawal permission switched off. Give the key a clear label naming the service and the date. Each exchange's official help centre explains its API permission options and where they are set. Store the secret only in the service that uses it, never in screenshots, chats or notes on a shared device.

Add IP restrictions and a separate sub-account

If the service publishes fixed server addresses, restrict the key to those addresses so a stolen key cannot be used elsewhere. Consider running the bot on a sub-account holding only the funds you are prepared to let it trade, if your exchange supports sub-accounts. This limits the impact of a bug, a bad strategy or a compromised service. Check the bot's activity regularly rather than leaving it unattended for weeks.

Monitor and retire keys

Review your API key list every month. Delete keys for services you have stopped using and any key you cannot identify. If you notice unexpected orders, delete the key immediately, cancel open orders and contact support from inside the official app. Keep a short record of each key: the service, permissions, creation date and deletion date. That record makes reviews quick and helps support if anything goes wrong.

Risk boundary: Philippines Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Research who runs a bot service and avoid any that promise a fixed profit or no-loss outcome.
• Never enable withdrawal permission on a key given to a third-party tool.
• Label each key with the service name and creation date.
• Restrict keys to the service's fixed IP addresses where supported.
• Run bots in a sub-account funded only with money you accept it may trade.
• Review the key list monthly and delete keys you no longer use.