What Data Can a Crypto Trading Bot Access Through an API Key?
Read, trade, withdraw — three tiers, one that matters for a bot. See exactly what an API key can and can't touch.
An API key for a trading bot is not a password. It's a scoped permission slip: an exchange lets you turn on exactly three things — reading your account data, placing and cancelling trades, and withdrawing funds — and a properly configured trading bot only ever gets the first two. The third, withdrawal, is the one permission a bot has no legitimate reason to hold, and every major exchange lets you leave it switched off.
The three tiers every exchange offers
Binance, Bybit, OKX, Kraken, and Gate.io all split API access into the same three functional scopes, whatever their own settings menus call them:
Read and trade together are enough for a bot to do everything it's supposed to: check the market, open a position, adjust it, close it. Withdrawal moves money off the exchange entirely, which has nothing to do with running a strategy — a point independent security researchers make the same way: one third-party analysis of exchange API permissions notes trading rights are effectively unavoidable for any bot, but withdrawal is "the most dangerous right," and should stay off regardless of what platform is asking for it.
What "trade" actually covers on a futures bot
For spot bots, trade permission is simple: place and cancel buy/sell orders. Futures trading adds a bit more under the same "trade" umbrella — a bot running a COMBO or DCA Futures strategy needs to open and close positions, and typically also needs to adjust leverage and margin on those positions as part of executing the strategy. That's still entirely within the trade scope; it doesn't require withdrawal rights, and it doesn't give the bot any ability to move the underlying collateral off the exchange. If you're connecting a futures-capable key, expect to see leverage/margin adjustment listed as part of what trade permission covers on that exchange — it's a normal part of the same tier, not a separate, riskier permission.
The permission that actually neutralizes a leaked key: IP whitelisting
Permission scope isn't the only lever. Most exchanges also let you restrict an API key to a specific IP address, so that even a leaked key string is useless from anywhere else — as one analysis puts it, "an attacker who captures the character string can do nothing with it as long as he is not also sending from precisely that address." Binance goes further and enforces this by default: without an IP restriction set, it automatically deselects trading rights on a key after 90 days. That's worth knowing on its own, separate from the permission-tier question — it's also one of the more common reasons a bot quietly stops trading with no other change on your end (see why did my bot stop trading if that's happened to you).
Why "trade-only" isn't a marketing line
When a platform says its bots run on a trade-only key, that's a specific, checkable claim: the withdrawal toggle is off, and the exchange itself — not the bot platform — enforces it. Bitsgap's own key requests only ask for read and trade permissions; if you generate a key on your exchange with withdrawal enabled and try to connect it, that's a mismatch between what you granted and what the platform needs, not a sign it needs more. For the deeper safety case — what happens with a leaked trade-only key, and why non-custodial status matters more than the permission toggle alone — see Is It Safe to Connect Your Exchange API to a Trading Bot?.
What read-only actually shows
A read-only key is more revealing than people assume, even without trade rights: full balance across every asset, complete order history, open positions, sometimes deposit addresses. It's not a risk to funds, but it is a privacy exposure — a reason to still restrict read-only keys to services you trust, and to check what any third-party analytics tool is asking for before granting it. Tax-reporting tools and portfolio trackers, for example, only ever need read access; if one of them asks for trade permissions, that's worth questioning directly, since there's no legitimate reason for a reporting tool to place orders on your behalf.
Checking your own key's scope
On any of the five exchanges above, the API management page lists each key's active permissions next to it, usually as a row of toggles or badges. If a key you created for a bot shows withdrawal as enabled, fix it immediately — delete it and generate a new one with only read and trade turned on, plus an IP restriction if the exchange supports it, then reconnect. The bot's actual behavior doesn't change; the risk if that key ever leaked does.
The permission toggle you never touch is the one that decides whether a leaked key is a nuisance or a disaster.
FAQ
Can a trading bot's API key move my funds off the exchange? No, not if the key is scoped correctly. Withdrawal is a separate, optional permission that a trading bot has no functional need for — Bitsgap's key requests never ask for it.
What's the difference between read and trade permissions? Read lets a program view your balance, orders, and history. Trade lets it place and cancel orders. A bot needs both; neither one lets it withdraw.
Does a futures bot need any permission beyond read and trade? No. Leverage and margin adjustment for futures positions fall under the same trade permission — it's not a separate, higher-risk scope, and it still doesn't grant withdrawal rights.
Does IP whitelisting actually matter if my key already has no withdrawal rights? Yes. It protects against misuse of the permissions the key does have — a leaked trade-only key restricted to your IP address is useless to anyone else, even if they have the key string itself.
Is a read-only API key completely risk-free? It can't move funds, but it does expose your balance and trade history to whoever holds it. Only grant read access to services that clearly need it, like reporting tools.
