What is a crypto API key and is it safe to share?

A crypto API key is a credential that lets outside software connect to your exchange account. It usually comes as a public key plus a secret, and the software uses them to sign requests. Binance Academy compares a key to a username and password for programs, which is why exchanges ask you to keep it confidential.

What is a crypto API key used for?

People create API keys to connect their exchange accounts to other tools. Common examples are portfolio trackers, crypto tax software and trading bots. Instead of logging in as you, the tool sends requests signed with the key, and the exchange answers only within the key's permissions.

Binance Academy notes that some keys use a single shared secret (HMAC), while others use a public and private key pair (RSA or Ed25519). Either way, the secret part must stay private.

What exchange API key permissions can you set?

When you create a key, you choose what it can do. Kraken's documentation lists permissions such as querying funds, querying open and closed orders, creating and cancelling orders, exporting data, depositing and withdrawing. Binance lists similar options, including read-only, spot and margin trading, transfers and withdrawals.

Exchanges give consistent advice on setting them:

• Least privilege. Grant only what the tool needs. Binance.US says a tax platform should get read-only access, not trading or withdrawals.
• Avoid withdrawal access unless it is truly required.
• Restrict by IP address. Kraken calls IP whitelisting the single measure that stops almost all misuse of a leaked key. Binance requires it for withdrawal permissions.
• Use separate keys for separate services, so one leak stays contained.
• Rotate and delete. Binance.US suggests replacing keys every 90 days and deleting unused ones.

How do API key scams in crypto work?

The main risk is someone else getting a key that can trade or withdraw. In December 2022, attackers obtained API keys stored by the trading bot service 3Commas. Halborn reports they used the keys to place trades on users' exchange accounts, routing an estimated $20 million to their own wallets. Halborn does not describe a direct withdrawal method, which shows that a key with trading rights alone can still cause losses.

The same risk applies to any service you hand a key to, including unknown bot or "signal" services. Whoever holds the key can use every permission it carries. Keys can also leak through malware or code shared online. Binance Academy names accidentally committing keys to a public code repository as a common path.

Is it safe to share an API key?

Sharing a key is always a trust decision. Binance.US says to treat API keys like passwords and give them only to platforms you trust. A read-only, IP-restricted key shared with an established tool carries much less risk than a key with trading or withdrawal rights. If you suspect a key is exposed, delete it on the exchange right away, then review your account using how to secure a crypto exchange account.