Exchange API Security
Safely connecting Binance, Bybit, and OKX via non-custodial API keys with proper permissions and IP restrictions.
Non-Custodial by Design
Algonney never holds your funds. Your assets remain on the exchange at all times. API keys authorize the bot to place and manage trades on your behalf, but they cannot withdraw or transfer funds when configured correctly.
Your keys, your coins. Algonney uses trade-only API permissions with no withdrawal access.
Creating Secure API Keys
When creating API keys on any exchange, follow these mandatory steps:
- 1Enable only "Futures Trading"
Never enable withdrawal permissions. On Binance, uncheck "Enable Withdrawals". On Bybit, select "Order" permission only. On OKX, choose "Trade" scope.
- 2Restrict to IP Whitelist
Where your exchange supports it, restrict the API key to Algonney's published server IPs (contact Support for the current list). This prevents anyone from using your keys from an unauthorized location.
- 3Set a Strong Passphrase
Use a unique, randomly-generated passphrase for each key. Never reuse passphrases across exchanges.
- 4Rotate Keys Periodically
Create new keys and retire old ones every 90 days. Algonney supports seamless key rotation without stopping active bots.
Exchange-Specific Settings
- • Enable "Futures Trading" only
- • Disable "Enable Withdrawals"
- • Restrict to trusted IPs only
- • Do not enable "Vanilla Options"
- • Select "Order" permission only (no "Wallet" or "Transfer")
- • Set IP restriction to Algonney's published server IPs (see Support)
- • Use a unique API key per trading account
- • Select "Trade" scope only
- • Do not grant "Withdraw" or "Transfer" permissions
- • Bind IP addresses in the API management panel
What Algonney Does With Your Keys
Exchange API credentials are encrypted at rest using envelope encryption with restricted access. Keys are decrypted only in memory when placing or managing trades, and are never logged, cached, or transmitted to third parties.
If you delete an API key from Algonney, all encrypted key material is permanently removed from the database. Active bots using that key are automatically stopped.