Bitget API key permissions for a bot
Bitget's API docs split read-only, trade, transfer and withdraw, and they say withdrawals only work from a whitelisted IP.
Permissions
The UTA REST docs (Bitget API documentation) say each UID can create 10 API keys, each read only or read/write. Read-Only queries data such as market data. Trade places and cancels orders. Transfer moves coins between accounts. Withdraw takes assets out, and only through a whitelisted IP.
Withdrawals
A bot that trades does not need Withdraw or Transfer. The docs say leaking the secret or the passphrase can lose the assets, and they say Bitget staff do not need those secrets.
IP allowlist
The same page says you can only withdraw through a whitelisted IP, and that binding an IP when you create the key is strongly recommended for security.
Sub-accounts
Sub-accounts (virtual and standard) can create and manage their own API keys once the main account turns on API Key Management for that sub-account. That switch is off by default. The main account can still view, edit or delete a sub-account key.
How to revoke
The docs say that if a key is compromised, delete it as soon as possible. The passphrase cannot be recovered. If you lose it, create a new key.
Worst case for your money, and the safe setup: Bitget check.
Listing, with the safety facts we track: Bitget.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
What Bitget API permissions does a bot need?
Read-Only, plus Trade if it places orders. Leave Transfer and Withdraw off.
Does Bitget require an IP whitelist for API withdrawals?
Yes. The docs say you can only withdraw coins through a whitelisted IP, and they strongly recommend binding an IP on every key.