Keeping your access code safe

Before binding your exchange API, please keep these points in mind:

• Enable only the "Trade" permission — never enable the "Withdraw" permission. This way, even if your Key leaks, no one can move your money away.
• Never share your Secret with anyone, and don't screenshot it to send in group chats or to customer support.
• If your exchange supports it, we recommend enabling an IP whitelist to further restrict the scope of use.
• Periodically check the API usage records in your exchange's backend, and delete the Key immediately if you notice anything abnormal.

We store your Secret encrypted, but security at the source matters just as much — the fewer permissions you grant, the safer you are.

For the detailed application steps, see "Binding Your Exchange API".