API

Create API keys (and why they cannot withdraw)

Keys can read data and trade. There is no withdrawal permission, so a leaked key cannot move funds out.

Go to Account, then API keys, and choose Create API key.
Name the key and list the public IP addresses your program sends requests from, 1 to 20. Ranges are not supported.
Confirm with your passkey. An account without a passkey adds one under Security first.
Copy the key ID and the secret. The secret is shown only once: if you lose it, revoke the key and create a new one.

Every key can trade and none can withdraw: withdrawals always need your passkey in the app. Revoking a key stops it at once.

API

Keys can read data and trade. There is no withdrawal permission, so a leaked key cannot move funds out.

Go to Account, then API keys, and choose Create API key.
Name the key and list the public IP addresses your program sends requests from, 1 to 20. Ranges are not supported.
Confirm with your passkey. An account without a passkey adds one under Security first.
Copy the key ID and the secret. The secret is shown only once: if you lose it, revoke the key and create a new one.

Every key can trade and none can withdraw: withdrawals always need your passkey in the app. Revoking a key stops it at once.