Setup

Binance API keys for a bot (safely)

Most blown accounts in this niche are not “bad strategy.” They are keys that can withdraw, keys sitting in a public repo, or keys with no IP lock. Do this part slowly.

Never enable withdrawals on a bot key. If a key can move coins off the exchange, a leaked file becomes a drained account. No strategy needs withdraw permission.

What the bot actually needs

• Read account info (balances, open orders)
• Create and cancel spot orders
• Futures only if you truly understand liquidation

You do not need withdrawals, internal transfers, or extras you will not use.

Create the key on Binance

1. Log in on the official site. Do not follow a search-ad lookalike.
2. Open API Management.
3. Create a new API key. Name it something dull like vps-bot-spot-readonly-first.
4. Complete 2FA. Store the secret key once. You will not see it again.
5. Edit restrictions immediately.

Lock it down

IP allowlist

Put only the VPS public IPv4 on the key. If you rebuild the server and the IP changes, auth errors mean the restriction is working. Update the allowlist. Do not turn it off “for a minute.”

BINANCE_API_KEY=
BINANCE_API_SECRET=
BINANCE_BASE_URL=https://api.binance.com

On the server: chmod 600 .env. Do not hardcode secrets in Python.

If a key leaks

1. Delete the key in Binance first. Do not debug first.
2. Rotate to a new key with a new secret.
3. Check withdrawal history and device logins.
4. Assume any copy of .env in email or chat is burned.

Keep reading