Bybit API key permissions for a bot
Bybit's API docs say what happens to a key with no IP binding, and they say an API withdrawal has to be on the master account and on an address already saved.
Permissions
The create-sub-account-key page (create sub UID API key) takes a readOnly flag (0 read and write, 1 read only) and permission groups such as Contract Trade, Spot, Options, Wallet, Exchange and Copy Trading. A master key that calls this endpoint needs Account Transfer, Subaccount Transfer or Withdrawal permission. That page is about creating a key. It does not say which of those a third-party bot should get.
Withdrawals
The withdraw endpoint (Withdraw) says the request uses the master UID's API key only, and that the wallet address or Bybit UID has to be in the address book first. A bot key does not need withdrawal permission. Leave it off, and keep the address book limited to wallets you control.
IP allowlist
On the create-key page, passing no IPs, or *, means no bind. A key with no IP bound is invalid after 90 days. A key with no IP bound is also invalid 7 days after the account password changes.
Sub-accounts
That same page creates an API key for a sub UID. The master key is what is allowed to create it.
How to revoke
The two pages we opened do not describe a delete call. Delete the key in your Bybit account. A leaked key with no IP binding still works until the 90-day or password rule kills it, so delete it yourself.
Worst case for your money, and the safe setup: Bybit check.
Listing, with the safety facts we track: Bybit.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
What Bybit API key permissions should a bot have?
Read only, or read and write for the products it trades. Do not grant Withdrawal. Bybit's withdraw endpoint is for the master account key and only pays addresses already in the address book.
Do Bybit API keys expire?
A key with no IP bound is invalid after 90 days, and 7 days after a password change. Bind the bot's IP.