How to connect a third-party trading terminal safely with trade-only API keys

To connect a third-party trading terminal safely, give it an API key that can trade futures but cannot withdraw or transfer funds, and restrict that key to the terminal's server IP address. With those two settings, a leaked key can at worst place trades: it cannot move money out of your account, and it cannot be used from anywhere else.

The rest is good housekeeping: store the secret carefully, rotate keys from time to time, and delete the keys you no longer use. This guide goes through each step and what to look for in the terminal itself.

What an API key can do

An exchange API key comes in two parts: a public key that identifies you and a secret that signs each request. Whoever holds both can act on your account within the permissions you enabled. That is why permissions matter more than anything else. A key with withdrawal rights is, in practice, access to your money; a key without them is access to your trading.

Set the right permissions

When you create the key in your exchange's API management page, enable only what the terminal needs:

• futures trading: on, so the terminal can place and close orders;
• withdrawals: off, because a trading terminal never needs to send funds out of your account;
• transfers between accounts or wallets: off, because moving funds is not part of trading either.

Reading account data comes with every key. If a terminal asks you to enable withdrawals or transfers, treat that as a red flag, whatever the reason given.

Restrict the key to an IP address

Most exchanges let you limit a key to a list of trusted IP addresses. For a terminal that runs on a server, add only that server's address. Requests signed with your key from anywhere else are then rejected, which turns a stolen key into a useless string of characters.

A terminal that runs on a server should tell you exactly which address to allow. If it cannot, or if it suggests leaving the key unrestricted, ask why before you connect it.

Store the secret carefully

The exchange shows the secret only once, when you create the key. Paste it straight into the terminal and do not keep a copy in a notes app, a chat or a screenshot. Never send it to anyone, including someone who says they are support; no legitimate support team needs your secret.

A well-built terminal encrypts the secret at rest, never displays it again after you save it, and keeps it out of logs and error messages.

Rotate keys and clean up

Rotate keys from time to time. Create a new key with the same restrictions, add it to the terminal, check that it works, then delete the old key on the exchange. Delete a key at once if you stop using a service or suspect it has leaked, and review the list of active keys in your exchange account every so often.

For extra separation, some traders connect a terminal to a sub-account that holds only the funds they intend to trade with. A problem with that key then stays inside that sub-account.

A quick checklist before you connect

• Futures trading is the only trading permission the terminal needs.
• Withdrawals and transfers are off.
• The key is restricted to the terminal's server IP address.
• The secret exists in exactly one place: the terminal.
• You know how to delete the key on the exchange if you ever need to.

How Mos Terminal handles API keys

Mos Terminal connects to Binance USDⓈ-M futures with a key you create. It checks the key's permissions before saving it and refuses any key that can withdraw or transfer funds or that is not restricted to our server's IP address. Saved keys are encrypted with AWS KMS. Mos re-checks the permissions every few minutes; if a key gains withdrawal or transfer rights later, new trading locks while closing positions stays possible. Your funds never leave your Binance account.

Key takeaways

• Give a terminal a futures-trading key with withdrawals and transfers turned off.
• Restrict the key to the terminal's server IP so a leaked copy is useless anywhere else.
• Treat the secret like a password: paste it once and never share it.
• Rotate keys from time to time and delete the ones you no longer use.
• A trustworthy terminal never asks for withdrawal rights and never holds your funds.

Mos Terminal enforces a hard stop and a day breaker on our server for Binance USDⓈ-M futures, so your limits hold even with the browser closed. It is in invite-only beta.

Educational content, not financial advice. Futures trading carries a high risk of loss.