Exchange API key safety for bots and AI agents
Which permissions a bot or AI agent needs on Binance, Bybit, OKX, Coinbase, Kraken, KuCoin, Bitget and Hyperliquid, why withdrawals stay off, and how IP allowlists and revocation work. Each page cites that exchange's own docs.
A key that can withdraw can empty the account from anywhere the allowlist permits. Trade permission is enough for a bot that places orders. Read-only is enough for a bot that only watches balances. Create the key on a sub-account or a separate portfolio when the exchange offers one, so a leak does not touch the rest of the funds.
The directory of exchanges, with safety scores, is crypto exchanges for trading bots. Looking up a Telegram bot instead? Official bot links.
| Exchange | Check |
|---|---|
| Binance | Check |
| Bybit | Check |
| OKX | Check |
| Coinbase | Check |
| Kraken | Check |
| KuCoin | Check |
| Bitget | Check |
| Hyperliquid | Check |