Kraken API key permissions for a bot
Kraken's permissions guide says a key that only places orders does not need Withdraw Funds, and that IP whitelisting stops most misuse if a key leaks.
Permissions
The guide (API key permissions) says you pick permissions at Settings, then API. A read-only dashboard needs Query Funds, Query Open Orders and Trades, and Query Closed Orders and Trades. Placing orders needs Create and Modify Orders and Cancel/Close Orders. Funding operations are a separate row: Query Funds, Deposit Funds and Withdraw Funds.
Withdrawals
The guide says to set the minimum permissions, and that a key used only for placing orders does not need Withdraw Funds. It warns that withdrawal permissions should only be on keys that genuinely move funds, with strict IP whitelisting, because a compromised withdrawal key is a direct loss.
IP allowlist
Under security best practices, Kraken says to use IP whitelisting and lock the key to the addresses the trading system runs from. The guide says this one step prevents almost all key misuse if the key leaks.
Sub-accounts
The same page links a sub-accounts guide and says to issue independent API keys per sub-account so strategies stay separate.
How to revoke
The permissions page we opened tells you to rotate keys and not to embed them in source code. It does not name a revoke button. Delete or rotate the key on Kraken's API settings page, and do not leave the old secret in a bot config.
Worst case for your money, and the safe setup: Kraken check.
Listing, with the safety facts we track: Kraken.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
What Kraken API permissions does a bot need?
Query permissions, plus Create and Modify Orders and Cancel/Close Orders if it trades. It does not need Withdraw Funds.
Does Kraken recommend an IP whitelist on API keys?
Yes. The permissions guide says to lock the key to your trading system's IP addresses.