Glossary
What is an exchange API key?
Also called: exchange API key, API credentials, trading API key
Updated Ninja Terminal team
Definition
An exchange API key is a credential pair that lets a program access your exchange account through the exchange's API instead of the website. It consists of a public key and a secret. You choose its permissions, such as reading data, trading, or withdrawing, and you can restrict it to specific IP addresses.
Trading software uses API keys to read balances and positions and to place orders on your behalf. The funds stay in your exchange account.
What permissions can a key have?
| Permission | Allows |
|---|---|
| Read | View balances, positions, and orders |
| Trade | Place and cancel orders |
| Withdraw | Move funds out of the account |
Give a key only the permissions it needs. For a trading terminal, use trade-only keys without withdrawal permission. If a key leaks, the damage is then limited to trading on that account. See the API key security checklist.
What do the venues document?
- Binance: a key created without an IP restriction can only read data. Enabling trading needs an IP restriction, a self-generated key type, or disabling default controls. Withdrawal permission requires an IPv4 restriction.
- OKX and Bybit: keys carry permission sets that you pick when you create them. Steps are in the guides for OKX and Bybit.
- Hyperliquid: it does not use exchange-issued keys. You approve an API wallet (agent wallet) that signs on behalf of your account. The docs describe it as used only to sign, and account data queries must use the master or sub-account address. See connecting a Hyperliquid API wallet.
How does Ninja Terminal handle keys?
Ninja Terminal encrypts API keys with AES-256-GCM and stores them on your device, in the browser. Orders run on your own exchange account, and funds never move to Ninja Terminal. See accounts and key security.
Frequently asked questions
Is it safe to give a trading terminal an API key?
It is safer with trade-only permission, no withdrawal permission, and an IP restriction. Never share a key with withdrawal permission.
Is an API key the same as my password?
No. It is a separate credential with its own permissions, and you can delete it without changing your password.