API Key Security Check - Before You Connect a Trading Bot

The 2022 3Commas leak drained six figures from trade-only keys. Work through this before connecting any platform to an exchange account.

Withdrawal permissions on the API key are disabled The key is IP-whitelisted to the bot platform's published IPs (or uses OAuth fast-connect) This key is only used for this one service - no reuse anywhere The exchange balance is working capital only - no long-term holdings on a key-connected account I know how to revoke the key immediately (exchange UI, tested) and will do so on any warning I checked the platform's incident history (our incident timeline covers the majors) I considered exchange-native bots or self-hosting - both remove third-party key risk entirely

check the boxes…

Why each item matters

Trade-only permissions did not save victims in 2022 - attackers drained accounts by trading illiquid pairs against their own orders. IP whitelisting, one key per service, and low balances are the mitigations that actually limit damage. Vendor transparency matters too: platforms that denied breaches while users lost money scored worse in our safety dimension than platforms that disclosed fast. Read the full background in the API key security guide → and the incident timeline →