What is API key?

What does API key mean in practice?

Exchanges let you create keys with specific permissions, typically read, trade and withdraw. A trading tool needs only to read balances and place orders, so only those two permissions should be enabled. The key is a separate credential from your login and can be revoked at any time.

The crucial setting is withdrawal permission. With it disabled at the exchange, no software holding the key can move funds out, however it is compromised. IP allow-listing, where an exchange offers it, adds a second layer.

A worked example

Illustrative only: create a key with read and trade enabled, withdrawals off, and allowed only from one IP address. If the key leaks, an attacker can read balances but cannot withdraw and cannot use it from elsewhere.

How to read or test it

Treat creating a key as a checklist. Name it for the tool it belongs to, enable read and trade only, leave withdrawal disabled, and add an IP restriction if the exchange offers one. Store it nowhere you would not store a password. Review your active keys now and then and delete any you no longer use. If you ever suspect a leak, revoke the key at the exchange first and investigate afterwards.

How AKQX handles API key

AKQX stores exchange API keys encrypted and needs only read and trade permission. It never needs withdrawal permission and holds no customer funds. Removing a key stops anything using it.

See Security and API key safety for the feature page.

A common mistake

Enabling withdrawal permission on a key given to any trading platform, including this one.

Related terms