API Permissions Guide
Understanding and configuring the correct API permissions is crucial for security and functionality. This guide explains what permissions TradeStaq needs and why.
Overview
API keys allow TradeStaq to interact with your exchange account. Each permission level grants specific capabilities:
| Permission | Purpose | Required? |
|---|---|---|
| Read | View balances, positions, orders | ✅ Yes |
| Trade | Place and cancel orders | ✅ Yes |
| Withdraw | Transfer funds out | ❌ Never |
Note: Never enable withdrawal permissions for TradeStaq API keys. TradeStaq never needs to withdraw funds and enabling this permission is a significant security risk.
Required Permissions by Exchange
Binance
| Permission | Required | Purpose |
|---|---|---|
| Enable Reading | ✅ | View balances, positions |
| Enable Spot & Margin Trading | ✅* | Execute spot trades |
| Enable Futures | ✅* | Execute futures trades |
| Enable Withdrawals | ❌ | Never enable |
*Enable based on your trading type (spot, futures, or both)
ByBit
| Permission | Required | Purpose |
|---|---|---|
| Read | ✅ | View account data |
| Trade | ✅ | Execute trades |
| Position (Derivatives) | ✅ | Manage positions |
| Wallet | ❌ | Not needed |
| Withdraw | ❌ | Never enable |
OKX
| Permission | Required | Purpose |
|---|---|---|
| Read | ✅ | View account data |
| Trade | ✅ | Execute trades |
| Withdraw | ❌ | Never enable |
Bitget
| Permission | Required | Purpose |
|---|---|---|
| Read Only | ✅ | View account data |
| Trade | ✅ | Execute trades |
| Transfer | ❌ | Not needed |
| Withdraw | ❌ | Never enable |
KuCoin
| Permission | Required | Purpose |
|---|---|---|
| General | ✅ | View account data |
| Trade | ✅ | Execute trades |
| Transfer | ❌ | Not needed |
Hyperliquid
| Permission | Required | Purpose |
|---|---|---|
| Read | ✅ | View positions |
| Trade | ✅ | Execute trades |
IP Whitelisting
Most exchanges support IP whitelisting - restricting API access to specific IP addresses.
Benefits
- Prevents unauthorized access even if keys are leaked
- Adds an extra security layer
- Required by some exchanges for trading permissions
How to Configure
- Get TradeStaq server IPs from hello@tradestaq.com
- Add these IPs to your exchange's API whitelist
- Save and verify the connection works
Note: IP whitelisting is highly recommended but optional. If you have issues, you can temporarily disable it for troubleshooting.
TradeStaq Server IPs
Contact hello@tradestaq.com for the current list of server IPs to whitelist.
Permission Errors
"Insufficient Permissions"
Cause: API key doesn't have required permissions.
Solution:
- Log into your exchange
- Go to API Management
- Edit the API key
- Enable missing permissions (Read, Trade)
- Save changes
- Try reconnecting in TradeStaq
"Read Only Key"
Cause: Only Read permission is enabled.
Solution:
- Enable Trade permission on your exchange
- For futures, enable Futures/Derivatives permission
- Save and reconnect
"IP Not Whitelisted"
Cause: Your API has IP restrictions that don't include TradeStaq servers.
Solution:
- Add TradeStaq server IPs to whitelist
- Or temporarily disable IP restrictions
- Reconnect the exchange
Security Best Practices
API Key Management
- One key per service - Don't share keys across platforms
- Descriptive labels - Name keys clearly (e.g., "TradeStaq Trading")
- Minimum permissions - Only enable what's needed
- Regular rotation - Change keys every 90 days
- Immediate revocation - Delete compromised keys immediately
Secret Key Storage
- Never share your secret key with anyone
- Don't store in plain text files
- Don't commit to version control
- Use password managers for storage
Monitoring
- Check API logs - Most exchanges show API activity
- Set up alerts - Enable email notifications for API usage
- Review regularly - Check for unauthorized activity
- Monitor balances - Watch for unexpected changes
What TradeStaq Does With Permissions
Read Permission
Used to:
- Fetch account balances
- Get open positions
- Check order status
- Sync trade history
Trade Permission
Used to:
- Place market orders
- Place limit orders
- Set stop loss/take profit
- Cancel pending orders
- Close positions
Note: TradeStaq only executes trades when triggered by your configured signals or bot strategies. No trades are made without your explicit configuration.
Revoking Access
To remove TradeStaq's access to your exchange:
- In TradeStaq: Delete the exchange connection
- On Exchange: Delete or disable the API key
- Verify: Check that no new trades are executed
Note: Always delete API keys on the exchange itself. Deleting the exchange in TradeStaq doesn't revoke the API key.
FAQ
Why doesn't TradeStaq need withdrawal permission?
TradeStaq only needs to trade on your behalf. Withdrawals would move funds out of your exchange - something a trading bot should never do. This is a critical security boundary.
Can I use a key with withdrawal enabled?
Technically yes, but strongly discouraged. If your API key is ever compromised, a key with withdrawal permissions could result in total loss of funds.
What if I need to change permissions later?
Most exchanges allow editing API key permissions. Make changes on the exchange, then click "Sync" in TradeStaq to verify the connection still works.
Are my API credentials stored securely?
Yes. API credentials are encrypted at rest and in transit. They're never logged or exposed in plaintext. See our security documentation for details.