When configuring a Binance API for the first time, always enable read‑only permission and bind an IP whitelist. This completely avoids the risk of unauthorized trading or funds transfers. It is ideal for non‑trading tasks like fetching market data or syncing your positions.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Step 1: Go to the API creation page and complete identity verification
Log in to your Binance account, go to the User Center – API Management page, and choose to create a new API. Complete the two‑factor authentication via SMS or email, enter a custom API name, and click confirm. Once done, the system will automatically open the API permission configuration page.
Step 2: Enable read‑only permission and turn off all trading and transfer permissions
On the permission configuration page, only tick the "Read" option. Uncheck all options for Spot & Margin trading, Futures trading, Withdrawals, and Internal transfers. The success standard: the permission bar shows only read‑type permissions are active.
A common mistake: users accidentally tick the withdrawal permission without noticing. If the API key is later leaked, all spot assets in the account can be transferred out directly.
The world's largest cryptocurrency exchange by trading volume,leading in security and liquidity.
New user benefit: Enjoy 20% off trading fees upon registration!
Step 3: Add and bind an IP whitelist
Select the "Restrict access to IP" option and enter the fixed public IP address you will use to make API calls. You can add multiple IP ranges in bulk. The success standard: the page shows the bound IP list exactly matching the addresses you entered.
Risk reminder: If an API key without an IP whitelist is leaked, hackers can make calls from anywhere. If trading permissions were accidentally enabled, all assets in the account can be transferred within one minute (source: Binance official help center, 2024‑05‑20).
How to verify the setup: After generating the API key, use the whitelisted IP to call any market data endpoint. A normal response means the configuration is working. Calls from an IP not on the whitelist will return a permission interception error.
