Table of contents
- Map exchange API keys to the bots using them
- Review permissions before creating or reconnecting a key
- Audit private keys and OAuth connections separately
- Store exchange API keys outside shared files
- Rotate exchange API keys without rebuilding the connection
- Revoke exchange API keys immediately after exposure
- Repair invalid credentials and retire unused access
Manage exchange API keys by keeping an access inventory, granting only required permissions, replacing credentials before expiry, and revoking unused or exposed keys at the exchange. For a trading bot, the critical distinction is between stopping automation and removing its authorization. Plan both actions, then inspect orders and positions directly at the exchange after changes (secrets management guidance).
Map exchange API keys to the bots using them
An exchange API lets software request account information or submit authorized trading actions. Credentials authenticate those requests; their permissions determine what the application can do. Kraken distinguishes access to balances and order history from actions such as placing orders and withdrawing funds (API security guidance).
Start an inventory without copying secrets into it. Record the exchange, account, connection name, responsible person, intended bot, permissions, creation date, and any expiry date. Add a masked identifier so you can match the record to the exchange screen. Treat this as your maintenance checklist, not a place to store credentials.
Cornix provides account cards with connection status and an account-details panel containing masked API-key information, helping you match a connection to your inventory (account monitoring guide). For the broader distinction between connection security and trading risk, read the crypto bot safety guide.
For example, suppose your inventory contains 8 credentials: 5 serve current bots and 3 belong to retired tests. The cleanup calculation is 8 - 3 = 5 credentials retained. Revoke the 3 retired credentials at their issuing exchanges, then match the remaining 5 to their current owners and purposes; this counts access records, not dollars or trading exposure.
Review permissions before creating or reconnecting a key
Use separate credentials for unrelated applications where supported. Keep testing and production credentials separate, and give each connection a descriptive name. This makes cleanup more targeted: retiring a test should not require guessing which live bot shares its credentials.
For a confirmed exchange example, Kraken Pro places key creation under the account menu, Settings, then API. Select Create API key and configure its name and permissions. Its permission groups distinguish querying funds, querying orders, modifying orders, and canceling orders (Kraken Pro key setup).
Apply this checklist to the actual connection requirements:
- Read access: Enable the balance, order, and position information the workflow needs.
- Trading access: Enable required order creation, modification, and cancellation actions.
- Withdrawal access: Leave it disabled for a trading-bot connection.
- IP restrictions: Use the automation provider's documented outgoing addresses when the exchange supports restrictions.
Permissions should reflect the application's job, rather than every available checkbox. Read-only access cannot submit orders, while trading permission still authorizes consequential account activity. A restricted key does not judge whether the strategy is suitable.
Treat the exchange connection and the bot's strategy settings as separate responsibilities: changing credentials is not a reason to change sizing or exits. The automated trading workflow guide explains how strategy input, bot configuration, and exchange execution fit together.
Audit private keys and OAuth connections separately
A manually entered API secret and an OAuth connection require different maintenance. With OAuth, an application obtains scoped access tokens through an authorization process instead of asking you to hand over your account password. Tokens still represent delegated access and need their own revocation process.
During an access review, inspect both the exchange's API-key list and its third-party application controls. Do not assume an empty key list proves that no application has access. Match each authorization to a current purpose and an owner; remove connections that no longer serve that purpose. OAuth and manually generated keys should both appear in your access inventory, with their respective removal routes recorded.
Store exchange API keys outside shared files
Keep secrets in an encrypted credential store with access restricted to the people or services that need them. Do not put them in chat messages, screenshots, support tickets, source code, or shared configuration files. For custom bots, redact credentials from logs and diagnostic exports before sharing them.
Review access when an operator leaves, a device is replaced, or a deployment changes. Keep the inventory separate from the secret itself, and remove obsolete credential copies after replacement. These are recommended housekeeping steps, not a guarantee against misuse.
Rotate exchange API keys without rebuilding the connection
For planned rotation, schedule a maintenance window and identify the orders and positions that need supervision. Decide who will watch the exchange while the connection changes. Use this sequence as a maintenance checklist:
- Pause new automated activity using the applicable bot controls.
- Record current orders, positions, and connection settings without exporting secrets.
- Create replacement credentials at the exchange with the required permissions and restrictions.
- Update the existing application connection rather than creating an unnecessary duplicate.
- Test account access and review the resulting connection state.
- Revoke the old credential at the exchange and record completion.
To replace credentials in an existing connection, open Portfolio > Accounts, locate the affected account card, and choose Edit from its three-dot menu. Enter the replacement API Key and Secret Key, then select Save. Using Edit rather than deleting the connection preserves historical trade and portfolio data.
Do not resume solely because authentication succeeds. Review account balances, market selection, open orders, and the bot's intended behavior before restarting. Decide how existing trades will be supervised during the change; a connection test should answer an operational question, not serve as a profitability test.
Revoke exchange API keys immediately after exposure
For suspected exposure, prioritize removing authorization over a smooth handover. Sign in directly to the exchange and revoke or delete the affected credential through its key-management controls. Then inspect activity, orders, and positions, investigate the exposure, and replace credentials only through a trusted environment. OWASP distinguishes revocation from stopping the application: credentials remain usable until the issuing service invalidates or expires them.
Treat order cancellation and position closure as separate decisions. Inspect them directly rather than assuming credential removal completed either action. Record what remains open and who is responsible for managing it.
A deleted exchange key is detected when the system attempts to place a trade, which automatically deactivates the bot. Remove authorization at the exchange rather than waiting for this bot status change.
Repair invalid credentials and retire unused access
An Invalid connection status can indicate expired credentials, insufficient permissions, or a key deleted at the exchange. Use the account card's Edit option to repair the connection; Deactivate temporarily pauses the connection, while Delete permanently removes it.
Diagnose the cause before broadening access. Compare permissions with the intended task, check expiry, and review IP restrictions against the provider's connection instructions. Replace an expired credential; correct a permission mismatch without enabling unrelated capabilities. Keep the exchange account available for direct supervision while troubleshooting.
For permanent retirement, remove authorization at the exchange, inspect remaining orders and positions, and then clean up the unused application connection. For routine replacement, retain the existing connection and its history. Use the API-key reconnection guide to carry out the documented Cornix update steps.
Frequently Asked Questions
How often should I rotate exchange API keys?
Set a rotation schedule that reflects the exchange's expiry rules and your operating policy, rather than assuming one interval fits every connection. Review access after staffing or system changes, and revoke exposed credentials immediately instead of waiting for a scheduled rotation.
Is an exchange API secret the same as a wallet private key?
No. Exchange API credentials authenticate requests to an exchange account under assigned permissions. They are not a self-custody wallet's blockchain signing key. Handle the secret as sensitive account access, and never substitute a wallet recovery phrase into an API connection.
Can an unused key stop working even if I did not delete it?
Yes. Kraken may disable API keys or revoke trading permissions, including after several months of dormancy. Keep direct exchange access available so you can investigate a stopped connection rather than repeatedly restarting the bot.
