Binance API key permissions for a bot
Give a bot the smallest Binance key that can do the job. The permission rules live on Binance's own FAQ. That FAQ did not return its article text when we requested it again.
Key types we could re-read
Binance's API key types note on GitHub (api_key_types.md) says authenticated endpoints for trading and account history need an API key. It lists Ed25519 (recommended), HMAC (deprecated) and RSA. It does not list Read, Trade or Withdraw tick boxes.
Permissions, withdrawals and IP limits
Binance's support article How to create API keys on Binance did not return article text on 2026-10-27 (HTTP 202, empty body). What follows in the next paragraph is what our check recorded from that same article on 2026-10-24, not a sentence we re-read today. System-generated HMAC keys with no IP restriction could only have Enable Reading. Turning on withdrawal permission required an IPv4 access restriction. Binance recommended against non-read permissions without an IP restriction. The article did not state an expiry rule.
What to do with a bot or agent
- Prefer a key that can read, or read and trade, and leave withdrawals off. The 2026-10-24 read of the FAQ says a key with no IP limit is stuck on Enable Reading.
- If the bot must trade, bind the key to that server's IPv4 address. The same FAQ said an IP restriction is required before withdrawals can be enabled, and recommended an IP restriction for any non-read permission.
- Sub-accounts are not described in the key-types note we opened, or in the FAQ text recorded on 2026-10-24.
- How to revoke: the pages we opened do not spell out the delete click. Remove the key from the API screen on binance.com while you are signed in, and do not paste the secret into a chat or a repo.
Open Binance: binance.com
Worst case for your money, and the safe setup: Binance check.
Listing, with the safety facts we track: Binance.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
Which Binance API permissions does a bot need?
Reading, plus trade only if it must place orders. Leave withdrawals off. Binance's FAQ, as we recorded it on 2026-10-24, limits a system-generated key with no IP restriction to Enable Reading.
Should a Binance bot key have an IP allowlist?
Yes if it can do more than read. The FAQ we recorded says an IPv4 restriction is mandatory before withdrawal permission can be turned on.