Glossary
What is an API key IP whitelist?
Also called: IP restriction, IP binding, trusted IP addresses, IP allowlist
Updated Ninja Terminal team
Definition
An IP whitelist for an API key is a list of IP addresses that the exchange accepts requests from. Requests from any other address are refused, even when the key and secret are correct. It limits the damage from a leaked key, because an attacker also needs to send requests from a listed address.
An API key proves who is calling. An IP whitelist adds a check on where the call comes from.
How does it work?
- You create the API key on the exchange.
- You add the IP addresses that may use it.
- The exchange refuses any call from another address.
The list must match the addresses your trading software uses to reach the exchange. If your software uses fixed addresses, you pin the key to them. If the addresses change, requests fail until you update the list.
What does Binance document?
Binance calls the feature IP access restriction, in IPv4 format. Keys without it can only read data. Withdrawal permission requires the restriction. Since 2023-01-30 (UTC), system-generated keys can only have read permission when the IP is unrestricted.
Other venues let you bind keys to addresses as well. The screens and rules differ, so follow the steps for your venue in the guides for Binance, OKX, and Bybit.
Is it enough on its own?
No. Use it together with minimal permissions: trade-only, no withdrawal. See the API key security checklist.
Where does it appear in Ninja Terminal?
The account setup flow gives you the IP addresses to whitelist so you can pin your keys. If an exchange rejects a request because of the IP list, Ninja Terminal shows a dialog that helps you fix the whitelist. See accounts and key security.
Frequently asked questions
Do I need an IP whitelist?
It is strongly recommended. On Binance, a key without an IP restriction is limited to read access, so trading needs the restriction or another allowed setup.
What happens if my IP changes?
If the exchange sees a request from an address that is not on the list, it rejects the call. Update the whitelist with the new address.