How to Create an API Key Without Withdrawal Permission

To use a bot, you need to create an API key on your exchange. How you create it changes your level of risk: a well-configured key lets you trade without exposing your balance to withdrawals. This guide covers the general steps, which apply to most exchanges.

What an API key is

An API key is a pair of codes (the key and the secret) that lets a program act on your account without using your password. When you create the key, you choose what it can do. The most common permissions are:

• Read: view balance, positions and history.
• Trade: open and close orders.
• Withdraw: take money out of the account. Do not tick this one.

General step by step

1. Log in to your account and turn on two-factor authentication if you have not already.
2. Find the “API” or “API Management” area in the settings. The name and location vary by exchange.
3. Create a new key and give it a name that identifies its use, such as “Multi Arbitrage”.
4. Tick only read and futures trading. Leave withdrawal and transfer unticked.
5. If the exchange allows it, restrict the key to the bot’s IP.
6. Confirm with 2FA, copy the key, the secret and (if there is one) the API passphrase, and store them somewhere safe. The secret usually appears only once.
7. Add the key to the system and run the order test to confirm everything is working.

Official documentation for each exchange

Each exchange explains the process in its own documentation. A few references: Binance, Bitget, OKX, Gate, KuCoin and MEXC. Screens change over time, so always check the current documentation.

Good practices after creating it

• Use one key per service, not the same one across several bots.
• Review your keys from time to time and delete the ones you no longer use.
• If you suspect anything, revoke the key on the exchange right away.
• Avoid keeping the secret in loose files or screenshots.
• No Multi Arbitrage project needs withdrawal permission.

How to test that the key is right

After adding the key to the system, run the order test with a minimum amount. It confirms whether the key can read your balance, whether it can send futures orders and whether the permissions are correct. If the test fails, the system shows the reason and the steps to fix it, such as an IP that has not been whitelisted, a missing permission or the position mode.

Most common mistakes when creating the key

• Forgetting to tick the futures or trade permission.
• Copying the key with extra spaces or without the full secret.
• Not whitelisting the IP when the exchange requires it.
• Mixing keys from two exchanges in the same entry.
• Creating the key on a sub-account with no balance.

Frequently asked questions

Read also

Security

API IP Whitelist: What It Is and When to Use It

An IP whitelist limits where an API key can be used. Learn how it works, what to watch out for and why it helps protect your exchange account.

3 min read

Security

7 Common Crypto Bot Scams and How to Avoid Them

The most common scams involving crypto bots, signals and arbitrage, with warning signs and a checklist to protect yourself before sharing your API key.

3 min read

Security

Two-Factor Authentication (2FA) on Crypto Exchanges

How to turn on 2FA on a crypto exchange, which method to use (authenticator app or SMS), how to store recovery codes and what to avoid.

2 min read

Multi Arbitrage TeamInformational content about crypto arbitrage and futures. Not investment advice.