Managing API Keys Safely

Managing API Keys Safely

API keys allow third-party applications, trading bots, and your own scripts to interact with your ByteExchange account. Proper key management is essential for security.

Creating an API Key

  1. Go to Settings > API Management.
  2. Click Create API Key.
  3. Give it a descriptive label (e.g., "Trading Bot", "Portfolio Tracker").
  4. Set permissions:
  • Read — View balances, orders, and market data
  • Trade — Place and cancel orders
  • Withdraw — Initiate withdrawals (use with extreme caution)
  1. Set IP restriction (strongly recommended).
  2. Verify with 2FA and email code.
  3. Copy and securely store the API Key and Secret Key.
Warning: The Secret Key is shown only once. If you lose it, you must delete the key and create a new one.

Permission Best Practices

  • Principle of least privilege: Only grant the permissions your application needs.
  • Never enable Withdraw unless absolutely necessary.
  • Read-only keys are safest for portfolio trackers and monitoring tools.

IP Restriction

Always restrict your API keys to specific IP addresses:

  • Add the IP address(es) of the server running your bot.
  • If your IP changes frequently, use a VPN with a static IP.
  • Unrestricted keys are vulnerable if the key is compromised.

Security Checklist

  • Store API keys in environment variables, never in source code.
  • Do not share keys in screenshots, chat messages, or forums.
  • Rotate keys periodically (every 3-6 months).
  • Delete unused keys immediately.
  • Monitor API key activity in your account logs.

What to Do If Compromised

  1. Immediately delete the compromised key in API Management.
  2. Check your recent order and withdrawal history.
  3. Change your account password and 2FA.
  4. Contact support if you notice unauthorized activity.