How to Create and Manage API Keys on the Binance APP

API Keys: The Key to Unlocking Binance Automated Trading

If you are starting to use quantitative trading bots, third-party market data tools, or writing your own trading scripts, you will need to work with Binance's API keys. An API (Application Programming Interface) allows external programs to interact with your Binance account through code — querying balances, placing orders, retrieving market data, and more.

But an API key is like a physical key: misconfigure it and you have essentially left the front door of your account wide open. In this tutorial, I will cover everything from creating and configuring to securely managing your API keys.

Basic Concepts of API Keys

Key Components

Each API key consists of two parts:

• API Key (public key): Functions like a username; used to identify your identity
• Secret Key (private key): Functions like a password; used to verify the legitimacy of requests

Important: The Secret Key is only displayed once at the time of creation and cannot be viewed again. If you lose it, the only option is to delete the old key and create a new one.

Permission Types

Binance API keys support the following permission settings:

1. Read Permission: Query account balance, order history, and market data
2. Spot Trading Permission: Place orders, cancel orders, and other spot trading operations
3. Futures Trading Permission: Futures trading operations
4. Withdrawal Permission: Initiate withdrawal operations (high risk — enable with caution)
5. Margin Trading Permission: Margin trading operations

Creating an API Key in the APP

Steps

1. Open the Binance APP
2. Tap your profile picture in the top-left corner > "Security"
3. Find "API Management" and tap it
4. Tap "Create API"
5. Give the key a meaningful label (e.g., "Trading Bot", "Market Monitor")
6. Complete the security verification (SMS + email + Google Authenticator)
7. The system will display your API Key and Secret Key
8. Immediately copy and securely save your Secret Key (this is the only time you can view it)
9. Configure the key's permissions

Permission Configuration Recommendations

Based on your use case, grant the minimum necessary permissions:

Scenario 1: View market data and assets only

• Enable "Read" permission only
• Disable all trading and withdrawal permissions

Scenario 2: Using a trading bot

• Enable "Read" and "Spot Trading" permissions
• Enable "Futures Trading" permission only if needed
• Do not enable "Withdrawal" permission

Scenario 3: Using a portfolio management tool

• Enable "Read" permission only
• These tools only need to read data; they do not need trading permissions

IP Whitelist Settings

This is the most critical security configuration for API keys:

1. Find "IP Restrictions" on the API key settings page
2. Select "Restrict access to trusted IPs only"
3. Enter your server's IP address or the fixed IP of your home network
4. Once configured, only API requests originating from whitelisted IPs will be accepted

If you do not set up an IP whitelist, anyone who obtains your API key can make requests from any location.

Secure Management of API Keys

Storage Security

1. Do not hardcode API keys in your code: Use environment variables or configuration files instead
2. Do not upload keys to public code repositories such as GitHub: This is the most common way keys get leaked
3. Use encrypted storage: Store keys in encrypted configuration files or a password manager
4. Do not transmit keys through instant messaging apps: Chat logs in tools like WeChat or Telegram can be compromised

Principle of Least Privilege

Follow the "minimum privilege principle":

• Grant only the permissions that are necessary — nothing more
• Create separate API keys for different purposes
• Delete keys that are no longer needed promptly
• Never enable withdrawal permission unless it is absolutely necessary

Regular Reviews

It is recommended to review your API keys once a month:

1. View all active API keys
2. Delete keys that are no longer in use
3. Check whether the permissions for each key are appropriate
4. Confirm that IP whitelist settings are still effective
5. Review the usage logs for each API key

Important Notes for Third-Party Tool API Authorization

Extra caution is required when using third-party trading tools:

Evaluating a Tool's Trustworthiness

1. Choose well-known, market-proven tools: Such as 3Commas, Pionex, etc.
2. Check user reviews and security track record: Look for any past data breach incidents
3. Understand how the tool handles your data: Find out how they store your API key
4. Prefer tools that support a "read-only" mode

Authorization Principles

1. Create a separate API key for each third-party tool
2. Grant only the minimum permissions that tool requires
3. Set the IP whitelist to restrict access to that tool's server IP
4. Delete the corresponding API key immediately after you stop using the tool

Red Flag Warnings

The following situations should raise your suspicion:

• A tool asks you to enable withdrawal permission
• A tool asks you to disable the IP whitelist
• A tool asks you to provide account credentials beyond your Secret Key (such as your password)
• A newly launched, unrecognized tool promises extraordinarily high returns

Troubleshooting Common Issues

API Request Returns a Permission Error

1. Confirm the key's permissions include the operation you are attempting
2. Check whether the IP whitelist includes the IP your request is coming from
3. Confirm the key has not been disabled or deleted

API Request Rate Limits

Binance enforces rate limits on API requests:

• Maximum 1,200 requests per minute (weighted)
• Maximum 10 order requests per second
• Exceeding the limit will result in a temporary ban

Solutions:

1. Optimize your code to reduce unnecessary requests
2. Use WebSocket instead of polling to receive real-time data
3. Set appropriate intervals between requests

Lost Secret Key

The Secret Key is only displayed once at creation and cannot be recovered if lost. The only solution is:

1. Delete the current API key
2. Create a new API key
3. Update the configuration for all applications that were using the old key

Suspected API Key Compromise

Take the following actions immediately:

1. Log in to the Binance APP and go to API Management
2. Immediately delete any potentially compromised API keys
3. Check your account for any unauthorized trades or withdrawals
4. Create a new API key with stricter security settings
5. Investigate the source of the leak (code repositories, chat logs, etc.)

API Key Management Best Practices Checklist

1. Create a separate API key for each purpose
2. Follow the principle of least privilege
3. Always set up an IP whitelist
4. Never enable withdrawal permission unless absolutely necessary
5. Immediately store your Secret Key securely after creation
6. Do not hardcode keys in your code
7. Do not upload keys to public code repositories
8. Regularly review and clean up keys
9. Add a clear descriptive label to each key
10. Immediately delete and recreate keys if they are compromised

Summary

API keys are powerful tools that let you leverage automation and third-party tools to optimize your trading strategies. But with great power comes great responsibility. A misconfigured API key is a security vulnerability. Remember the core principles: minimum permissions + IP whitelist + regular reviews, and you can enjoy the convenience of the API safely.

Register on Binance | Download Binance APP