Binding exchange API keys to an IP address: when it helps and how to set it up

Every API key is a password that never expires unless you make it. It sits in a config file, in a cloud dashboard or in a third-party service, and any of those can leak. Limiting permissions is the first line of defence: a key that can read balances but not trade or withdraw does limited damage. Binding the key to a fixed list of IP addresses is the second line, and it is the one that turns a leaked key into a string of characters nobody can use. All four large exchanges offer it, with slightly different wording.

Where the option lives

When you create a key in the API management section of Binance, OKX, Bybit or Bitget, the form offers a choice between unrestricted access and restricting the key to trusted IP addresses. Some exchanges limit the lifetime or the permissions of keys that have no IP restriction, and the creation page explains this. Choose the restricted option and paste one or more addresses. You can usually edit the list later from the same page without deleting the key, though a change may require a fresh two-step confirmation.

Finding the address to enter

The address must be the public IP that the exchange sees, not the local address of your computer. For a bot on a rented server, use the server's static public IP shown in the hosting dashboard. For a desktop tool at home, check the public address your router uses, but be aware that many home connections change address regularly, which will break the key without warning. For a third-party service such as a tax tool, look in its documentation for the list of IP addresses it asks you to whitelist; reputable services publish them.

Matching permissions to purpose

IP binding works best together with narrow permissions. A portfolio tracker needs read-only access. A trading bot needs reading and trading but not withdrawals. Withdrawal permission on an API key is rarely necessary for personal use, and when an exchange allows it at all, it usually requires an IP restriction plus an address whitelist. Create one key per tool, label it with the tool's name and the date, and never reuse the same key across services, so that revoking one does not break the others.

Maintenance and what to do after a leak

Every few months, open API management on each exchange and compare the list of keys with the tools you actually use. Delete keys for anything you stopped using. When you move a bot to a new server, add the new IP before switching off the old one, then remove the old address. If you suspect a key has leaked, delete it at once rather than editing it, check recent orders and withdrawals, and create a fresh key with a new secret. Also check that the exchange you use actually serves your country of residence under its current terms before relying on it for automation.

Risk boundary: Russia Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Choose the restricted IP option when creating any API key that a tool will use.
• Enter the public IP the exchange sees, such as a server's static address, not a local one.
• Use only the IP addresses that a third-party service publishes in its own documentation.
• Create one labelled key per tool with no withdrawal permission unless it is truly needed.
• Delete, rather than edit, any key you suspect has leaked and review recent activity.