Is it safe to give a trading bot your API key?

It is the last question almost every trader asks before connecting an automated platform, and it deserves a better answer than “yes, we’re secure.” The honest answer is: it depends entirely on what the key can do — and that is something you control at the exchange, not something you have to take on trust.

This post explains what an API key actually grants, the specific things worth checking before you connect anything, and the parts of the risk that no platform can engineer away.

This is educational only, and it is written to be useful regardless of which platform you end up using.

An API key is not a password

A password grants everything. An API key grants a specific, chosen set of permissions — and on every major exchange, those permissions separate cleanly into three:

• Read. See balances, positions, and order history. Cannot change anything.
• Trade. Place and cancel orders on your account. Cannot move assets off the exchange.
• Withdraw. Transfer assets out to an external address.

These are independent switches. A key with read and trade enabled and withdraw disabled is, structurally, incapable of sending your coins anywhere — not as a policy, not as a promise, but because the exchange will reject the attempt.

That is the whole basis of the answer. Everything else is detail.

The only scope that can lose your coins

Withdraw is the one that matters. If a platform asks for withdrawal permission on your exchange key, the reason has to be extraordinary, and “for your convenience” is not it. An automated trading system does not need to move assets off an exchange to trade them.

So the first rule is simple, and it applies universally: never grant withdrawal scope to a third-party trading platform. If the onboarding flow requires it, that is your answer about the platform.

Four questions worth asking

Any platform should be able to answer these in public. If the answers are hard to find, treat that as information.

1. Does it request withdrawal permission? It should not. Check what the setup instructions actually tell you to tick at the exchange.

2. Does it refuse a withdrawal-scoped key, or merely not use it? There is a real difference. “We don’t use that permission” relies on their good behaviour. “We reject the key at the point of saving” means a misconfigured key can’t sit in their database at all. Stralines does the second: paste a withdrawal-enabled key and it will not save.

3. How are keys stored? Encrypted at rest is the baseline, but the follow-up question is the real one: where is the decryption secret held? If it sits in the same database as the keys, the encryption buys very little — a database compromise takes both. It should live outside the database, separately scoped and rotated.

4. Can staff read decrypted key material? Operator tooling should never surface a usable secret, and access should be logged.

IP allowlisting — the control most people skip

Every major exchange lets you bind an API key to specific IP addresses. A key restricted this way is useless from anywhere else, which means a leaked key is a much smaller event: an attacker holding your secret still cannot use it from their own infrastructure.

This is an exchange-side control that you own, it takes a minute to set, and it is independent of anything your platform does or claims. If you connect a key anywhere, it is worth doing.

What “never holds customer funds” actually means

The phrase gets used loosely, so it’s worth being precise about the version that carries weight. There are two very different claims hiding behind similar wording:

• A promise: “we hold your funds but we won’t misuse them.” This depends on the operator’s solvency, competence and honesty. It is the claim that has ended badly, repeatedly, across this industry.

• A structural property: “your assets never leave your exchange account, and we never hold the permission that would let them.” There is nothing to misuse, because there is no custody.

Stralines is the second kind. Your coins stay in your exchange account under your own credentials. A full compromise of the platform still cannot move them out, because withdrawal permission was never granted in the first place. That is a much stronger guarantee than any assurance about internal controls, precisely because it doesn’t depend on us behaving well.

What a trade-scoped key can still cost you

Here is the part that security pages tend to skip, and it matters.

A trade-scoped key cannot steal your assets. It can still lose you money by trading badly. Anyone holding a working trade-scoped key could open positions, churn your balance on fees, or leave you exposed to a move. The blast radius is bounded by your account, not zero.

Which means the useful protections are the ones that limit what trading is allowed to do:

• Position and exposure caps — so no single bot can commit more than you decided.
• Per-bot drawdown limits and consecutive-loss halts — so a misbehaving strategy stops itself rather than running until you notice.
• A visible audit trail — every signal, order and fill queryable, so “what happened at 3am” has an answer.
• Fast revocation — covered below, and the most important one.

Risk caps are not just strategy tooling. They are part of the security model.

Revocation is the real safety property

The strongest thing about the API-key model is that you can end the relationship unilaterally, immediately, without the platform’s cooperation.

Exchange → API management → delete the key. That’s it. There is no support ticket, no notice period, no dependency on the platform being reachable or agreeable. The moment the key is gone, nothing can act on your account.

Two habits worth adopting:

1. Create a dedicated key per platform. Never reuse one key across services — it makes revocation surgical instead of disruptive.
2. Know where the revoke button is before you need it. Find it once, at setup, while nothing is going wrong.

Where Stralines sits

For completeness, and so the claims above are checkable:

• Read and trade scope only. Withdrawal permission is never requested, and a withdrawal-scoped key is refused when you try to save it.
• Keys encrypted at rest, with the decryption secret held outside the database, separately scoped and rotated.
• Every connection isolated — one connection’s risk never bleeds into another.
• Privileged operator surfaces gated at the network edge, separated end to end from public ones.
• You can try the product without a key at all. The backtest and marketplace are public. No account, no key, no card — which means you can evaluate the whole thing before this question even applies to you.

The full detail, including how to report a vulnerability, is on the security page.

Further reading

• Why your stop-loss disappears — what the trade permission is actually used for, and the operational failure it exists to survive.
• Position sizing and risk caps — the limits that bound what any key is allowed to cost you.

Closing

“Is it safe to give a bot your API key” is really two questions. Can it take my assets? — no, if you never grant withdrawal scope, and that is enforced by the exchange rather than by anyone’s promise. Can it lose me money? — yes, because trading can lose money, which is why caps, audit trails and one-click revocation matter as much as encryption does.

Stralines is software that runs on your account rather than a service that holds it. The distinction is the entire security posture, and it is the reason the honest answer to the title is “yes — provided you tick only two of the three boxes.”

Nothing here is investment advice. Capital is at risk in any trading activity.