The key and the secret do different jobs
The key acts like a pass number: it tells the exchange which connection sent the request. The secret proves that the request is authentic. It should never appear in a public document, a support chat or a form whose origin you cannot verify.
Exchanges commonly reveal the secret once. If it is lost, delete the old key and issue another. A service promising to recover the hidden value is solving a problem that should be handled by revocation.
Read, trade and withdraw
API authority falls into three useful groups. Read access covers balances, positions and order history. Trade access creates and cancels orders. Withdrawal access moves assets out of the account, which is unnecessary for ordinary trading automation.
Trade-only does not mean harmless. A stolen trading key can still open unwanted exposure. Removing withdrawal access is the minimum sensible control, not the end of the security model.
- Read: balances, positions and account history.
- Trade: open, change and close orders.
- Withdraw: move assets away; keep it disabled for a trading bot.
A calm setup sequence
Open the exchange settings yourself instead of following an unexpected message link. Give the key a name that includes the service and date. Six months later, that small detail makes it obvious which connection can be retired.
Use IP restrictions only when the service provides stable addresses and current instructions. A guessed allowlist does not create meaningful security; it merely causes intermittent failures.
Test behaviour before performance
The first test is predictability, not return. Confirm that the bot sees the intended account, reads the right balance and trades only the selected market. Start small and compare every Telegram notification with the corresponding exchange order.
Record the creation date. Routine key rotation is useful even without evidence of compromise: revoke the old credential and issue a replacement with the same minimal scope. If exposure is suspected, revoke first and investigate second.
Stopping the strategy is not revoking the key
A stop control inside an app tells the service to halt its algorithm. Removing the API key in the exchange account breaks the technical route. They are related actions, not the same action.
Inspect open positions and working orders before revocation. Deleting a key does not close them. Any position left behind must be managed directly on the exchange.