Setup

.env and chmod 600 (don’t commit keys)

Withdraw off is useless if the secret is in git, a screenshot, or a 644 file on a shared box. The key lives in .env. The mode is 600. The Python file never contains the secret.

If .env has ever been in git, Discord, email, or a screenshot, delete the exchange key first. Then rotate. Do not “fix git” while the old secret still works.

What belongs in .env

BINANCE_API_KEY=
BINANCE_API_SECRET=
TELEGRAM_BOT_TOKEN=
TELEGRAM_CHAT_ID=
DRY_RUN=true

That file sits next to the bot on the VPS only. systemd reads it with EnvironmentFile=. The process never prints the secret. Logs should show “key loaded,” not the key.

Lock the file

cd /home/YOURUSER/bots/openclaw
nano .env
chmod 600 .env
ls -l .env
# -rw------- 1 YOURUSER YOURUSER  …  .env

• Owner read/write only (600).
• Same user as the systemd service.
• Not in a directory other users can write.

Keep it out of git

# .gitignore
.env
.env.*
!.env.example

Commit .env.example with empty names only. If you already committed a real .env: delete the key on the exchange, git rm --cached .env, rotate, assume the history is public.

systemd must point at that file

[Service]
User=YOURUSER
WorkingDirectory=/home/YOURUSER/bots/openclaw
EnvironmentFile=/home/YOURUSER/bots/openclaw/.env
ExecStart=/home/YOURUSER/bots/openclaw/.venv/bin/python bot.py

A 401 after chmod is usually still IP allowlist or the wrong EnvironmentFile path — not “chmod broke Binance.” See Binance 401.

Keep reading