Exchange keys and safety
Short version for experts: tables, lists and screenshots only.
Words in this lesson (2)
What an API key is
An API key is a "pass" that the exchange gives a program so it can act on your behalf. A key has two parts: the key itself and the secret. It's created in your exchange account, in the "API" section.
A key has permissions. There are three kinds:
| Permission | What it allows | When you need it |
|---|---|---|
| Read | seeing balances and positions | always — this is where we start |
| Trade | placing and cancelling orders | when you move on to real trades |
| Withdraw | withdrawing coins from the exchange | only for transfers between your own exchanges |
Rules you must not break
- Start with a "read-only" key. In DEMO, trading uses no real money anyway.
- Bind the key to your IP address in the exchange account. Then the key works only from your computer.
- Withdrawal permission — only together with an address whitelist. On the exchange, turn on "withdraw only to whitelisted addresses" and add your own wallets on other exchanges. The confirmation code from the app and email is entered once, by hand, when adding an address.
- Never send anyone your key's secret — not in a chat, not "to support".
Important about VPN
The exchanges work without a VPN. The key is bound to an IP address, and under a VPN your address is different — the exchange refuses (error 403). If balances suddenly stopped loading, the first thing to check is whether a VPN is on.
Where to enter them
Settings → "Exchanges and connections" → the card with exchange keys. Each exchange has a field for the key and the secret. Only you enter the key: the mentor and support will never ask for it.
Further down in Settings there are separate cards:
- "API keys · news and data" — optional keys for news sources and an Alor token for real-time Russian stocks;
- "Artificial intelligence" — which AI powers the mentor (YandexGPT, GigaChat, Claude, ChatGPT, Gemini, DeepSeek, a model on your computer…), its key and the profile of your trained agent. From Russia without a VPN, YandexGPT, GigaChat and a model on your computer work.