iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Open Binance API Management to see exactly what each bot credential can do. For a read-only monitor, remove trading access; for a trading bot, retain only the product permissions required to place and manage orders. Do not grant withdrawal access to a bot unless you have a separately justified, tightly controlled process. Where the key and account support it, allowlist the bot host’s stable public IP addresses. If the key may have been exposed or account activity is suspicious, delete it immediately, inspect orders and positions, and follow Binance’s instruction to revoke keys and contact support.
The interface and eligibility rules can change. The steps below reflect Binance documentation and policy information available through 13 October 2026; use the labels and warnings displayed in your signed-in account.
What a Binance API key permits
An API key is a credential that software uses to authenticate requests to your Binance account. The key itself is not a password, but it can authorize actions that are far more consequential than ordinary market-data requests. The permissions shown in API Management determine which endpoint families the credential may call.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Permission or setting | What it is for | Typical bot need | Safer default |
|---|---|---|---|
TRADE |
Submitting, changing, and cancelling orders for the products enabled on the key. | Execution bots and systems that must manage open orders. | Enable only on a dedicated trading key and only for the required product scope. |
USER_DATA |
Authenticated account and order information, such as balances, order status, and account events that require user authentication. | Portfolio monitors, reporting tools, and bots that read account state. | Use for monitoring when no order placement is needed. |
USER_STREAM |
Authenticated user-data streams used to receive account or order updates. | Real-time dashboards and execution systems that consume user streams. | Grant only when the software actually opens a user-data stream. |
| Withdrawal access | Authorizes withdrawal operations if the account and key type allow the setting. | Almost never required by a trading bot. | Leave disabled. Binance says withdrawal permission requires IP access restrictions. |
| IP access restriction | Limits authentication to listed source IP addresses. | Any bot running from a host with stable public IPv4 addresses. | Allowlist only the addresses you control and monitor. |
Binance’s Spot API documentation uses separate keys as an example: a TRADE key for order execution and a USER_DATA key for monitoring. Splitting those duties limits the damage if a monitoring integration is compromised and makes an unexpected trade permission easier to spot.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Decide whether to edit, restrict, or delete a key
Start with the bot’s actual job, not the permissions it currently has. A key that was created by copying a broad template may contain access the software never uses.
| Situation | Best action | Reason |
|---|---|---|
| The bot only reads balances, prices, or order history. | Disable TRADE and withdrawal access; retain only the read or stream permissions required. |
A read-only service has no reason to place orders or move funds. |
| The bot places Spot or Margin orders and the credential is still controlled. | Keep the relevant trading permission, remove unrelated permissions, and add trusted IP addresses when supported. | This preserves operation while reducing the credential’s attack surface. |
| The bot trades a product it no longer uses. | Turn off that product’s permission or retire the key. | Unused product access creates unnecessary exposure. |
| The key, secret, host, or logs may have been exposed. | Delete the key, investigate activity, and create a replacement only after containment. | Editing permissions leaves the same credential in circulation; deletion invalidates it. |
| You cannot explain an unfamiliar permission or source IP. | Pause the bot and treat the key as potentially compromised until verified. | Unknown access should not be rationalized as a harmless default. |
Prepare before opening API Management
- Identify the bot or service that owns the key by its label, deployment, and operator. Do not rely on a secret value to identify it.
- Find the bot host’s current public IP address and determine whether it is stable. A changing residential or cloud address can lock out a legitimate bot after allowlisting.
- Record which products the bot is meant to trade and whether it needs order placement, order cancellation, account reads, or user-data streams.
- Have a maintenance window or a safe stop procedure. Changing permissions while a bot is actively submitting orders can produce rejected requests and leave orders unmanaged.
- Never paste the API key or secret into a chat, support ticket, public issue, screenshot, spreadsheet shared outside your security boundary, or untrusted form. Binance’s developer documentation treats both values as sensitive credentials.
How to review a key on the Binance website
- Sign in through Binance’s official website and complete the requested security checks. Do not use a link from an unsolicited message.
- Open your profile or account menu and select API Management. Binance’s current key-creation help identifies the profile/account area as the route to this page; the exact menu wording can vary by region and account mode.
- Locate the key by its label. If several entries have vague names such as “bot” or “test,” stop and map each entry to a known deployment before changing anything.
- Open the key’s details and inspect every permission toggle, product selection, withdrawal setting, and IP-access setting. Read any warning text shown for that particular key.
- Compare the displayed access with the bot’s documented requirements. A monitor normally needs account-read access and possibly a user-data stream; an execution bot needs trading access for the product it actually trades.
- Check the IP list. An empty or unrestricted list is not equivalent to “safe”: it allows authentication from more locations and may trigger special permission rules described below.
- Write down the intended final state before saving. This prevents accidentally enabling a permission while trying to disable another.
How to review a key in the Binance app
- Open the Binance app from a trusted, updated installation and sign in.
- Use the app’s search function and search for API Management. Binance’s security guidance describes this search-based route.
- Select the matching API-management result, then choose the key associated with the bot.
- Review permissions, product scope, withdrawal status, and IP restrictions exactly as you would on the website.
- If the app hides an advanced option or shows a different rule than the website, do not guess. Use the setting that is actually displayed for that key, and consult the current Binance help page before proceeding.
How to change Binance API key permissions safely
Disable trading on a read-only key
Open the key’s edit controls and switch off TRADE or the equivalent trading permission. Leave only the account-read or user-stream permissions the application needs. Save the change and wait for the confirmation message. A monitoring application should then continue to retrieve permitted data but receive an authorization error if it attempts to submit or cancel an order. Test that behavior with the bot’s documented non-destructive health check rather than by sending a live order.
Keep only the product scope the bot uses
Trading permissions can be separated by product or account mode. If a bot is a Spot strategy, it should not retain Futures access merely because the key was created from a broad template. Likewise, a Futures-only service should not be granted unrelated Spot or Margin capabilities. Product names and toggles differ by account type, so follow the live panel rather than assuming that one key has the same options as another.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Leave withdrawal permission off
Order execution and withdrawals are different risk categories. A trading bot ordinarily needs to buy, sell, amend, or cancel orders; it does not need to transfer assets away from the account. Binance’s help documentation states that withdrawal permission requires IP access restrictions, but the requirement is not a reason to grant withdrawals. If a legitimate workflow truly requires withdrawals, use a separate credential, a tightly controlled host, explicit operational approval, and the narrowest available limits instead of adding the capability to a general-purpose trading key.
Use a trusted IP allowlist when available
Enter only the bot host’s stable public IP address or addresses in the key’s IP-access control. Do not enter a private address such as 192.168.x.x; Binance must see the public source address used on the internet. If the bot runs behind a gateway, NAT device, load balancer, or cloud egress service, allowlist the actual egress address and confirm that it will not change during a restart or failover.
Allowlisting can lock out the bot if the provider rotates addresses. Before saving, verify the provider’s egress design and keep an emergency maintenance path that does not expose the secret. If the interface offers a choice between unrestricted access and a restricted list, treat unrestricted access as a temporary exception, not a permanent convenience.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Important key-type and account rules
Unrestricted HMAC keys may be read-only
Binance’s API-key help page, last updated 20 March 2025, says that under its stated security rules an HMAC key without IP restrictions cannot have permissions beyond reading. The same guidance identifies adding IPv4 restrictions or using self-generated key types such as Ed25519 or RSA as options for enabling other permissions. The available choices depend on the key and account shown in your interface. If a trading toggle is unavailable, do not work around it by creating a broad, unrestricted credential; review the displayed key-type requirements and create the narrowest compliant key.
Futures permission can be unavailable
Binance notes that Futures permission may be unavailable when a key was created before Futures was activated or when Portfolio Margin is active. This is an account-state limitation, not proof that the bot is misconfigured. Check the account mode and the key’s creation history before changing unrelated settings.
Portfolio Margin can permanently remove Futures access from old keys
Binance’s Portfolio Margin API guidance says that enabling Portfolio Margin removes Futures permission from existing API keys and that the removal is permanent for those keys. If a strategy still needs Futures access after that account-mode change, plan a new key that satisfies the current eligibility rules. Do not assume an old key can be repaired by toggling a switch.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Spot/Margin symbol whitelisting is limited
Binance documents an API Trading Symbol Whitelist feature for normal and managed sub-accounts. It can limit Spot/Margin API trading to selected pairs, with up to 30 pairs per sub-account API under the documented feature. This is not a universal setting for a main-account key and should not be treated as a Futures control. Confirm that the account is an eligible sub-account and that the pairs listed match the strategy before relying on the restriction.
The 30-day rule for keys without IP allowlisting
Binance’s 8 July 2021 announcement said Spot and Margin trading permission on a key without whitelisted IP addresses would expire after 30 days, while that permission would not expire under the announcement’s rule when IP addresses were whitelisted. This is a dated policy statement, not a guarantee that every key and current account follows the same behavior. Check the warning and expiration language shown in your live API Management panel before relying on a 30-day period.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe rule concerns Spot and Margin trading permission as described in that announcement. Do not generalize it to read access, user-data streams, withdrawals, Futures, every key type, or every region. If a bot stops trading after an apparent expiration, inspect the key’s current status and policy message rather than repeatedly recreating credentials.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
How to delete a Binance API key
Delete one key during routine cleanup
- Open API Management and select the key you have identified.
- Stop the associated bot so it cannot continue retrying with a credential you are removing.
- Choose the delete or remove action, read the confirmation warning, and complete the requested security verification.
- Confirm that the key disappears or is marked revoked in the list.
- Remove the old key and secret from the bot’s secret store, environment variables, deployment manifests, and logs. Deleting the Binance-side key does not erase copies that remain in your infrastructure.
Delete immediately when compromise is suspected
Possible warning signs include a secret appearing in a public repository, an unknown person or service having access to the host, unexplained order activity, unfamiliar IP addresses, or a bot behaving outside its strategy. Stop the bot, delete the affected key, and preserve relevant account and server logs for investigation. Binance’s developer documentation states: “If you notice unusual activity in your account, immediately revoke all the keys and contact Binance support.”
Binance’s security guidance for a described scam scenario gives an app route to API Management and a Delete all API flow. Use that broader action when you cannot reliably identify which key is safe. It invalidates legitimate integrations too, so schedule replacement work only after the account is contained and reviewed.
What deletion does not prove or automatically do
Revoking a key stops future authenticated API requests made with that credential. The available official guidance does not establish that revocation automatically cancels existing orders, closes positions, or reverses completed trades. After containment, inspect open Spot and Margin orders, Futures orders, positions, balances, and recent account activity through the account interface. Cancel or close anything unauthorized using the normal account controls, and contact Binance support for suspicious activity.
Also check every system that may have cached the credential: continuous-integration variables, container secrets, serverless settings, notebooks, desktop configuration files, backups, and chat transcripts. A replacement key is not safe if the same secret is still present in an exposed location.
Verify the bot after a permission change
- Replace the credential in the bot’s secret store only after the intended permission state is saved. Never place a secret directly in source code.
- Restart the bot in a controlled window and watch its authentication and permission errors.
- Run a read-only health check first: balance retrieval, market-data access, or order-status retrieval as appropriate.
- If the bot places orders, use its documented test or paper mode if available. Do not create a live order solely to prove that a permission exists.
- Confirm that order placement, amendment, cancellation, and user-stream handling work only for the product the bot is meant to manage.
- Check that requests originate from an allowlisted public IP. A rejected request after adding an allowlist usually indicates the wrong egress address, a changed cloud route, or an incomplete list.
- Review logs for unexpected endpoint calls. A bot that requests withdrawals, unrelated product data, or administrative functions should be investigated rather than granted another permission automatically.
Troubleshoot common failures
The bot receives a permission or authentication error
- Confirm that the bot is using the replacement key, not an old environment variable or cached container secret.
- Check that the required permission is enabled for the correct product and account mode.
- Compare the request’s source IP with the allowlist and verify the public egress address.
- Review key-type restrictions. An unrestricted HMAC key may be limited to reading under Binance’s current rules.
- Check whether Portfolio Margin or another account-mode change removed a permission from the key.
The bot works briefly, then stops
- Look for an IP change caused by cloud failover, a residential connection, or a new gateway.
- Inspect the key’s expiration or policy message, especially if it has no whitelisted IP and the account references the 30-day Spot/Margin rule.
- Check whether the application is making an endpoint call outside the permissions you intended; one denied call may trigger a fatal startup check.
You cannot tell which key a service uses
Stop the service, inventory its secret references, and compare labels and creation dates in API Management. Do not test by repeatedly enabling broad permissions. If ownership remains uncertain, revoke the ambiguous key and create a clearly labeled replacement with a documented owner, purpose, product scope, and review date.
Quick Recap
Operating practices for safer bot credentials
- Create separate keys for monitoring and execution so a reporting integration cannot trade.
- Use a separate key per bot or deployment rather than sharing one credential among unrelated services.
- Record the owner, purpose, products, allowed symbols where applicable, host IPs, and last review date in an internal inventory that does not contain the secret.
- Review permissions after strategy changes, server migrations, account-mode changes, and staff or vendor access changes.
- Rotate by creating a replacement, testing it, then deleting the old key; do not publish secrets in deployment files or logs.
- Keep withdrawal access disabled for ordinary trading automation.
- Monitor orders, withdrawals, and account events independently of the bot so a compromised process cannot hide its own activity.
A practical decision checklist
- What does the software do? If it only reads, remove trading and withdrawal access.
- Does it place orders? Enable only the required trading product and, where supported, the narrowest symbol scope.
- Does the host have stable public IP addresses? If yes, allowlist them. If no, solve the network design before granting broad access.
- Is the key type compatible with the required permission? Check the live account rules for HMAC, Ed25519, or RSA options.
- Could the credential be exposed? Delete it and investigate; do not rely on permission edits as containment.
- Could account mode have changed? Check Futures and Portfolio Margin status before troubleshooting the bot.
- After saving, did you verify behavior? Test intended functions and inspect logs for calls the bot should never make.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
