Security: least-privilege API keys
Security principles for connecting exchanges to fastbot — grant only what is needed, and never enable withdrawals.
1 min read·Updated September 16, 2026
A safe exchange connection starts with giving the API key only the minimum permissions it needs. fastbot is designed to never require withdrawal permission.
Core principles
- Never enable Withdraw permission. fastbot does not need it and will reject any Binance key that has it.
- Enable only trading permission for the exchange you use (Spot, and Futures if needed).
- If the exchange supports it, restrict by IP so only fastbot servers can use the key.
Protect your secret keys
- The Secret Key (Binance) and User Key (eToro) are shown only once — store them safely, treat them like passwords.
- Never paste keys into chats, screenshots or public notes. If one leaks, revoke and recreate the key on the exchange right away.
- Do not share keys with anyone. If you need help, @fastbot_support will guide you to do it yourself — we never ask for your secret keys.
How fastbot protects your funds
- fastbot never holds funds — your assets always stay on your exchange account.
- fastbot only reads your portfolio and places orders you request; it cannot move money out.
- You can revoke access anytime by deleting the API key on the exchange.
If you suspect a key is exposed
Revoke the key on the exchange immediately, create a new one with least privilege, then reconnect it to fastbot. Because the key has no withdrawal permission, your funds stay safe even in the worst case.