API IP Whitelist: What It Is and When to Use It
Even a key without withdrawals should be protected. One of the most effective layers is the IP restriction: telling the exchange that the key only works if the request comes from a specific address.
What an IP restriction is
Every server or computer on the internet has an IP address. With an IP restriction (also called a whitelist), you give the exchange a list of allowed addresses. Requests made with the key from any other address are rejected.
Why it helps
If someone steals your key and secret, they still need to use the allowed address to send orders. This greatly reduces the risk of misuse. It is cheap protection that does not get in the way of normal use.
Combined with a key without withdrawal permission and 2FA, it forms layered defense.
Important things to watch for
- Some exchanges require a fixed IP. If the bot’s IP changes, the key stops working until you update the list.
- Do not use the restriction if the service runs on changing addresses, unless the provider gives you the correct addresses.
- On some exchanges, keys without an IP restriction expire after a while or have limits.
- Always confirm the address with the service’s official support, never through a message from a third party.
How to set it up
- Ask the service for the outbound IP that should be whitelisted.
- When creating or editing the key, look for the IP, whitelist or “trusted IP” field.
- Enter the address and save with 2FA.
- Run the order test in the system to check that it works.
In Multi Arbitrage, the keys page shows the address to whitelist on the exchanges that ask for one, and there is an order test to validate it. Depending on the exchange, the IP may need to be registered before first use, and some require you to contact the exchange’s support.
Example scenario
Someone gets hold of your key’s secret through a leak. Without a restriction, they use the key from anywhere. With an IP restriction, the calls are rejected, because the request comes from an unauthorized address. The leak is still a problem, but the possible damage is much smaller.
When the restriction gets in the way
If the server changes address without notice, the key stops working until you update it. So confirm with the provider that the IP is fixed, and set a reminder to review the list if it changes. If in doubt, the service’s support should confirm the current address through an official channel.
Related guide: a crypto bot without withdrawal permission. See also all the crypto arbitrage guides.
Frequently asked questions
Do I need to restrict the IP?
It is not mandatory on every exchange, but it is recommended. Without a restriction, anyone who obtains the key can use it from anywhere.
Can I use my computer’s IP?
Only if the bot runs on your computer. If it runs on a server, the IP to whitelist is the server’s.
Do I need to recreate the key if the IP changes?
Usually you can just edit the IP list on the key. If the exchange requires it, create a new key.
Start with $30 in credits
Connect your exchanges with keys that can't withdraw and let the bot work. You pay 30% of the profit, and only when there is a profit.
Create my account →Read also
How to Create an API Key Without Withdrawal Permission
A general step-by-step guide to creating an exchange API key with read and trade access only, no withdrawals, plus tips for storing and revoking it.
3 min read
7 Common Crypto Bot Scams and How to Avoid Them
The most common scams involving crypto bots, signals and arbitrage, with warning signs and a checklist to protect yourself before sharing your API key.
3 min read
How to Know if a Crypto Exchange Is Trustworthy
A checklist for evaluating a crypto exchange: track record, liquidity, security, transparency, support and warning signs to check before you deposit.
2 min read
This content is for information only and is not investment advice. Trading crypto derivatives involves a high risk, including the total loss of your capital. Past results do not guarantee future results, and the figures mentioned are examples. Before trading, check whether trading crypto derivatives is allowed in your country and what your tax obligations are. Assess whether the product suits your profile before investing.