To use a quantitative bot or third-party tool with Binance, you need to create an API Key. But setting permissions incorrectly can either prevent functionality from working or put your assets at risk. Which of the three permission types should you choose?
Using the API feature requires first signing up for Binance and completing identity verification. You can manage API keys via the Binance App or web version.
What Are the Three API Permissions?
When creating an API Key, you need to choose which permissions to enable:
Read Permission:
- Query account balances
- View trade history
- Get market data
- View position information
- Cannot perform any modifications
Trade Permission (Enable Trading):
- Includes all read permission features
- Can place buy/sell orders (spot, futures, etc.)
- Can cancel orders
- Cannot withdraw
Withdrawal Permission (Enable Withdrawals):
- Includes all features of the above two
- Can initiate cryptocurrency withdrawals
- Highest risk level
Security Level Ranking
Read < Trade < Withdrawal
The higher the permission, the more severe the consequences if compromised. Only enable the minimum permissions you need.
What Permission for Each Scenario?
Only viewing data and analysis: Enable read-only. For data research, building market dashboards.
Quantitative trading bots: Enable read + trade. Bots need to query market data and auto-place orders. The vast majority of quantitative tools only need these two.
Automated withdrawals (rarely needed): Requires withdrawal permission. Generally not recommended unless you have very specific business needs with robust security measures.
Steps to Create an API Key
On the web:
- Log in to Binance
- Go to Account Settings → API Management
- Enter an API label name (to identify its purpose)
- Complete security verification (2FA)
- System generates API Key and Secret Key
- Save the Secret Key immediately — it's shown only once
- Set required permissions
- Configure IP whitelist (strongly recommended)
Important Note About the Secret Key
Creating an API generates two values:
- API Key: Like a username, can be viewed multiple times
- Secret Key: Like a password, shown only at creation
If you didn't save the Secret Key, you can only delete this API and create a new one. Copy and save it to a secure location immediately after creation.
Should I Set an IP Whitelist?
Strongly recommended. The IP whitelist restricts the API Key to specified IP addresses only. Even if leaked, attackers can't use it without the correct IP.
How to set it: In the API management page, find your API Key and add allowed IP addresses.
Using a static IP server: If your trading bot runs on a cloud server, add the server's IP to the whitelist.
What if my home IP changes: If your IP isn't static, you can skip the IP whitelist but should enforce other security measures and never enable withdrawal permissions.
API Security Best Practices
- Least privilege principle: Only enable needed permissions — if you don't need withdrawals, don't enable them
- Set IP whitelist: Set it if you can — dramatically reduces risk
- Rotate regularly: Periodically delete old APIs and create new ones
- Don't share: Never tell anyone your API Key and Secret Key
- Vet third-party platforms: When using third-party quantitative platforms, verify their security and reputation
- Enable 2FA: Enable Google Authenticator and other two-factor authentication on your account
- Monitor API activity: Regularly check API trade records and immediately delete keys if anomalies are found
Additional Restrictions for Withdrawal Permissions
Even with withdrawal permissions enabled, Binance has extra safety measures:
- Withdrawal address whitelist: Can only withdraw to pre-set addresses
- 24-hour cooling period: New withdrawal addresses require a waiting period
- Withdrawal limits: API withdrawals may have additional limits
How Many APIs Can One Account Create?
Binance allows each account to create multiple API Keys. You can create different APIs for different purposes with different permission settings. For example, one read-only key for data analysis and one with trade permissions for the quantitative bot.
What If My API Key Is Stolen?
- Immediately log in to Binance and delete all API Keys
- Change your account password
- Check for any abnormal trades or withdrawals
- Contact Binance support immediately if assets are lost
- Investigate the leak source to prevent recurrence
The API is a bridge between Binance and external tools. Security settings directly affect your asset safety. It's better to spend a few extra minutes configuring security options than to overlook risks for convenience.