The first time you create an API key on Binance, two principles matter most: least privilege and IP whitelisting. Simply put, only grant the API key the functions it absolutely needs, and only allow your server's IP address to access it.
Step 1: Create the API Key and Set Basic Permissions
-
What to do: Log into your Binance account, go to the API management page, create a new key, and configure basic permissions.
-
How to do it:
-
Log in to Binance, hover over your profile icon in the top-right corner, and click API Management.
-
Click Create API Key and choose the System generated option (recommended).
-
Name your key, complete the 2FA verification, then write down the API Key and Secret Key. The secret key is shown only once – store it securely.
-
Basic permissions: If you only need to view data or connect a read-only tool, check only "Read". If you plan to trade spot, also check "Spot Trading". Never enable the "Withdrawal" permission.
-
-
Completion goal: You have successfully generated an API Key and Secret Key with exactly the "Read" and/or "Trading" permissions your use case requires.
Step 2: Enforce IP Whitelisting (Your Most Critical Defense)
This is the most effective way to keep your API key from being misused.
-
What to do: In the API settings, restrict access to only your own server's IP address.
-
How to do it:
-
On the API management page, find the key you just created and click Edit permissions.
-
Locate and enable "Restrict access to trusted IPs only (recommended)".
-
Enter the public IP address of the server that will run your trading scripts or connect to the API.
-
Confirm and complete the verification. Binance strongly recommends this, especially if you ever plan to enable withdrawals – even without withdrawal permission, this barrier prevents abuse if the key is leaked.
-
-
Completion goal: IP whitelisting is turned on and your server's IP is correctly added. Even if the key is exposed, attackers cannot call it from any other network location.
Common Failure Reasons
The most frequent mistake is forgetting to set up IP whitelisting. If you see the error Invalid API-key, IP, or permissions for action, it very likely means your API key and server IP don't match, or you haven't enabled IP access restriction in your account's security settings.
Verification After Setup
After configuration, run a simple read-only request from your script, such as fetching the account balance. If it returns data normally, both the key and IP whitelist are set up correctly. Also, regularly check your API call logs for any access attempts from unknown IP addresses.
Next Steps
Store the Secret Key in an environment variable or a dedicated config file. Never hardcode it in your code or upload it to GitHub. Rotate your keys regularly – for example, generate a new one every 30–90 days and delete the old one. If you are a high-frequency trader, consider creating a separate sub-account for the API, isolating the risk from your main account.
