API key setup: read and trade, no withdrawals

Which permissions

The three exchanges name these permissions differently. A side-by-side comparison: Safe API key permissions on Binance, OKX and Bitget.

Why withdrawals stay off

Withdrawal permission can send coins to any address. If a key with that permission is stolen, you could lose the whole account, and on-chain transfers can't be reversed.

TonyTrade only needs to read the market, place orders and place stops. It never needs withdrawals. So:

• The app checks permissions when you enter a key. If it finds withdrawal permission, it refuses the key and asks you to make a new one.
• We offer no "auto-withdraw" or "auto-transfer" features of any kind.

Bind an IP whitelist

A key bound to an IP can only be used from the network addresses you list. Someone who gets the key can't use it from anywhere else.

Home internet IPs can change. When yours changes, the bound key stops working until you update the whitelist on the exchange. Some exchanges set an expiry on keys that have trade permission but no IP binding, and you have to make a new one when it expires. Current rules for each exchange are in the API key permissions guide. The exchange's own current documentation is what counts.

Keep funds in a sub-account

Open a sub-account on the exchange, put in only the funds you plan to give the strategy, and create the key on that sub-account. Then:

• If a strategy goes wrong or the key leaks, at most the sub-account's money is affected.
• Your main account's assets and other uses are untouched.
• When you review, the sub-account's profit and loss is the strategy's, not mixed with your manual trades.

Add TonyTrade's total position limit and maximum daily loss to shrink what can go wrong even further.

Where the key is stored

• Encrypted in your computer's operating system keychain, never written to a plain-text file.
• Never uploaded to any server, ours included. We can't see your key.
• The AI never gets the key. Only the chat and market data go to the model provider.
• Exchange keys are not stored on your phone. Your phone connects to TonyTrade on your own computer.

What this website collects and what it doesn't: Privacy.

How to create one: general steps

1. Log in to the exchange and open the API management page (usually under account or security settings).
2. Switch to a sub-account first if you're using one, then create the key.
3. Tick read and trade (spot and/or futures, as needed). Don't tick withdrawals.
4. Enter the IP whitelist. If you're not sure whether your IP changes, ask your internet provider.
5. After the exchange's security checks, copy the API Key and Secret (OKX and Bitget also have a passphrase you set yourself). The Secret is usually shown only once.
6. Enter them in TonyTrade. The app checks the permissions first, then tries reading your balance once.

Where each exchange puts these pages and what the options are called: API key permissions guide.

If a key leaks

1. Press the stop-all button in TonyTrade.
2. Delete the key on the exchange. It stops working immediately.
3. Check recent trades and open orders, and cancel any you didn't place.
4. Change your exchange login password and two-factor authentication, and check your computer for malware.
5. Create a new key using the steps above.

Other questions: FAQ. Which exchanges are supported: Exchanges and markets. To hear when there's a version to use, leave your email.