How to Connect an Exchange to a Trading Bot Safely
The exact settings for Coinbase, Kraken, Binance and Binance.US, and what Botsfolio checks before it stores anything.
Give a trading bot permission to trade and nothing else. Withdrawals stay off, so the money can't leave your exchange, and the key is restricted to the bot's IP address, so a leaked key is useless anywhere else. Coinbase connects to Botsfolio by signing in, with access that can read and place orders but never send funds. For Kraken, Binance and Binance.US you create an API key; Botsfolio checks it and refuses one that can withdraw, warns you if it works from any IP, and stores it encrypted. You can revoke access at any time on the exchange or by disconnecting in Botsfolio.
The rule: trade, never withdraw
A trading bot needs to see your balance and place and cancel orders. It never needs to move money off the exchange. If a connection can't withdraw, the worst a leak can do is place bad trades, not empty your account. Any service that asks for withdrawal permission is a red flag.
The second layer is an IP restriction. A key locked to the bot's server address doesn't work from anywhere else, even if someone copies it.
Coinbase: sign in, no keys
Coinbase connects to Botsfolio through Coinbase's own sign-in. You approve access on Coinbase's site, and the access covers reading your balances and placing orders. It can never send funds. There are no keys to copy or store, and you can remove Botsfolio's access in your Coinbase settings at any time.
Kraken
- On Kraken, open Settings, then Connections & API, and create a key.
- Tick Query Funds, Query Open Orders & Trades, Query Closed Orders & Trades, Create & Modify Orders and Cancel & Close Orders.
- Leave Withdraw Funds off.
- Under IP allowlist, add the IP address shown in the Botsfolio app.
- Paste the API key and private key into Botsfolio.
Binance
- On Binance, open Account, then API Management, and create a system-generated API key.
- Edit its restrictions: turn on Enable Spot & Margin Trading. Leave Enable Withdrawals off.
- Choose Restrict access to trusted IPs only and add the IP address shown in the Botsfolio app.
- Paste the API key and secret key into Botsfolio.
Binance.US
- On Binance.US, open Profile, then API Management, and create an API key.
- Allow trading. Leave withdrawals off.
- Restrict the key to the IP address shown in the Botsfolio app.
- Paste the API key and secret key into Botsfolio, and confirm that withdrawals are off. Binance.US doesn't let us check that setting, so we ask you to.
What Botsfolio checks before it stores a key
- The key can read balances and trade. Otherwise the AI couldn't work.
- The key can't withdraw. On Binance and Kraken we check, and refuse a key that can. On Binance.US you confirm it.
- The key is IP restricted. If it works from any address, you see a warning with the address to add.
- Your account's fee tier. Read so the AI and the cost estimate use your real fee.
- Stored encrypted. Keys and sign-in tokens are encrypted before they are saved.
What a trade-only key can still do
Turning withdrawals off stops theft by withdrawal. It doesn't make a leaked key harmless. In 2022, attackers who obtained API keys from the bot platform 3Commas used them to place trades that pumped thin coins and moved value out through the market rather than through withdrawals. That is why the IP restriction matters as much as the withdrawal setting: a key locked to one server can't be used from an attacker's machine.
Create a separate key for each bot or app and name it, so you can revoke one without breaking the others.
How to revoke access
- On the exchange: delete the API key, or remove Botsfolio from Coinbase's connected apps. It stops working immediately.
- In Botsfolio: disconnect the exchange in Settings. Botsfolio first cancels its open orders on the exchange, then removes the key or sign-in and stops the portfolios there. Details in what happens when you stop or disconnect.
Which exchange to connect
| Exchange | How you connect | Trading fee (maker / taker) | Smallest order | Where |
|---|---|---|---|---|
| Coinbase | Sign in with Coinbase. No keys to copy. | US: 0.50% / 0.90% at entry, lower with volume. EU, UK, Canada: 0.25% / 0.50%. Most other countries: 0.09% / 0.10%. | $1 | Most countries. Trades in USD in the US, USDC elsewhere. |
| Kraken | API key that can trade, with withdrawals off. | 0.40% / 0.80% at entry, lower with 30-day volume or assets held. | $5 | Not in India and a few other countries; in the US, not Maine or New York. |
| Binance | API key that can trade, with withdrawals off. | 0.10% / 0.10% (25% less when paid in BNB). | $5 | Not in the US, Canada, the Netherlands, the UK, Singapore or Japan. |
| Binance.US | API key that can trade, with withdrawals off. | 0% / 0.02%. | $10 | US only, and not every state. |
Fees differ a lot between them, and they change what the AI can earn. See exchange fees can turn a winning AI into a losing one.
FAQ
Exchange menus and permission names as of October 2026; exchanges change them from time to time. Not financial advice. Trading crypto can lose money.