What Is a Trade-Only API Key (and Why Your Bot Should Never Have Withdrawal Access)

If you run any crypto trading bot, this is the single most important safety setting you will touch: the API key permissions.

An API key is a credential that lets software act on your exchange account. But permissions are granular. A trade-only key can place and cancel orders — and nothing else. Crucially, you leave withdrawal disabled, so even if the key leaked, no one could move your funds off the exchange.

Why it matters

A bot only needs to trade to do its job. Giving it withdrawal rights adds enormous risk for zero benefit. Any bot that requires withdrawal access is a red flag.

Creating one safely

• In your exchange, create a new API key.
• Enable spot trading only.
• Leave withdrawal off — do not enable it “just in case”.
• Store the key and secret on your own machine; never paste them into a chat or a website.
• If your exchange supports it, restrict the key to your IP.

The BuySellAI DCA Bot is built around this principle — it is non-custodial and uses trade-only keys, so it can run your strategy but can never touch your money.