Set up a 3Commas or Bitsgap bot with a safe exchange API key (no withdrawals, IP whitelist)

✓ Written from official docs · checked 2026-10-17

Create an exchange API key that can trade but never withdraw, lock it to the bot's IP addresses, and test on a demo account first. Steps from the 3Commas and Bitsgap help centers.

Tools in this guide

Safety scores are calculated from our listing facts. They aren't a ranking, and affiliate links never affect them. How it works

1. Practice on a demo account first

3Commas has a Demo account with virtual funds and live prices (paid plans and the 7-day trial). Build and run your bot there before you connect real money. Bitsgap also offers demo trading on its platform.

2. Get the bot's IP addresses

3Commas: go to My Exchanges → Add exchange → pick your exchange. The connection widget lists the IP addresses to whitelist. 3Commas says to copy every IP shown there, not the ones in screenshots, or the connection can fail.

Bitsgap: go to My Exchanges → Add New Exchange (or Fix / Manual Replace on an existing key) and click the copy icon next to Bitsgap's trusted IPs. Bitsgap says IP whitelisting is required for Binance, KuCoin, Kraken and Crypto.com.

3. Create the API key on your exchange

Open your exchange's API management page (for example Binance: Account → API Management → Create API).
Turn on Read and Spot trading (and Futures only if your bot trades futures).
Leave withdrawals off. 3Commas: provide trading access only and disable withdrawals. Bitsgap rejects any key with withdrawals enabled and shows a "Withdrawal enabled" error.
Choose Restrict access to trusted IPs only and paste the IP list from step 2.
Copy the API key and secret somewhere safe. The secret is usually shown only once.

4. Connect the key to the bot

Paste the key and secret into 3Commas (My Exchanges → Add exchange) or Bitsgap (My Exchanges → Add New Exchange → Connect). Both check the connection. If it fails, the usual causes are a missing IP, missing trade permission or unfinished KYC on the exchange.

5. Check the key, then start small

On the exchange, confirm the key shows trade permission, no withdrawal permission and the IP restriction.
Run the bot with a small allocation first. Use a sub-account if your exchange offers one, so the bot can only reach that balance.
Delete keys you no longer use. 3Commas asks you to create new keys when its IP list changes.

FAQ

Can 3Commas or Bitsgap withdraw my funds?

Not with a key set up like this. Both tell you to leave the withdrawal permission off, and Bitsgap refuses keys that have it on. Without that permission the key can trade but can't move funds off the exchange.

Why whitelist IPs?

With an IP restriction, the exchange rejects requests from any other address, so a leaked key is much less useful to an attacker. Some exchanges also make keys without an IP restriction expire.

Sources

Not financial advice. Trading involves risk; test on paper first.