2026-05-28 5 min read

How to give a bot access without giving it your money.

The single most important thing to understand about connecting a trading bot to your exchange is this: API keys have permissions, and the permissions you grant decide what the bot can do.

Get this right and a bot is safe to use. Get it wrong and you're handing a stranger the keys to your wallet.

What an API key actually is

An API key is just a username + password generated by your exchange, specifically for programs (instead of people) to use. When you create one, you choose exactly which actions that key is allowed to perform. Bybit and Binance both give you a checkbox list — and that checkbox list is what makes the difference between safe and unsafe.

The permissions a grid bot needs

For Daily Trade — or any honest grid bot — you only need two things turned on:

✓

Spot trading So the bot can place limit buy and sell orders on BTC/USDT. This is the core function.

✓

Read account info So the bot can see your balance, confirm orders filled, and report numbers back to the dashboard.

The permissions you must NOT enable

Withdrawals — the critical one This is the toggle that decides whether a bot can move money out of your exchange. The bot doesn't need it. Leave it OFF.

Futures, margin, derivatives A spot grid bot does not touch leveraged products. Leave these off — there's no scenario where the bot accidentally triggers a liquidation if leverage isn't even enabled.

Sub-account transfers The bot doesn't need to move money between sub-accounts. Leave off.

Internal transfers Same logic — bot doesn't need it.

⚠ This is where 90% of crypto bot scams happen: a "free" bot asks for an API key with withdrawals enabled "for emergency closures" or "for advanced features." Then one day, your balance is empty. Never enable withdrawals on a bot's API key. Never. There is no honest reason a trading bot needs withdrawal permission.

What if my exchange forces me to enable withdrawals?

It doesn't. Both Bybit and Binance let you create API keys with withdrawals explicitly disabled — that's their default. If you're using a bot that requires withdrawal permission, the bot is the problem, not the exchange. Use a different bot.

IP whitelisting: an extra layer

Both Bybit and Binance let you restrict an API key to specific IP addresses. If you enable this, even if someone steals your API key from somewhere else, they can't use it unless they're connecting from your whitelisted IP.

For Daily Trade, we ask you not to IP-whitelist (because our trading server's IP can change occasionally during maintenance). For other tools or your own scripts, IP whitelisting is a strong defense. Use it where you can.

What happens if you lose access or want to revoke?

Three ways to instantly cut a bot off:

Delete the API key on the exchange. Go to API Management, find the key, click delete. The bot loses access in seconds. Your funds are completely safe.
Disable the bot in Daily Trade. Settings → toggle "Enable Bot" off. The bot stops within 60 seconds. Your existing orders stay on the exchange so you can cancel or let them fill, whichever you prefer.
Cancel the open orders on the exchange. If you want to clear everything immediately, log into the exchange and cancel all open orders. The bot has no way to re-place them once you've disabled it.

One last thing: protect your exchange account itself

None of this matters if someone hacks your exchange account directly. Make sure you have:

2FA enabled on the exchange (use an authenticator app, not SMS)
A unique strong password you don't use anywhere else
Anti-phishing code set up (so you can spot fake "Bybit support" emails)
Withdrawal whitelist if your exchange offers it — restricts withdrawals to addresses you've pre-approved

Daily Trade's security is good. Your own exchange account security has to be good too. They're separate layers.

Ready to set up your key safely?

We've made step-by-step guides for both Bybit and Binance, with screenshots showing exactly which boxes to check and which to leave alone.

Bybit guide Binance guide

← All articles