How to safely give a trading bot access to your Binance account

Handing a robot the keys to your exchange account sounds scary — until you understand what an API key actually is and, more importantly, what it cannot do.

An API key is not a password

When you create an API key on Binance or Bybit, you are not sharing your login. You are issuing a separate, revocable credential with a precise list of permissions that you choose. The exchange enforces those permissions on its side: if the key has no withdrawal right, no one holding that key — not the bot, not the platform, not even a hacker who somehow stole it — can move funds off your account.

The golden rule: no withdrawal permission, ever

A trading bot needs exactly two capabilities:

1. Read — to see balances and positions.
2. Trade — to place and cancel orders.

That is all. Vortoio will never ask you to enable withdrawals, and if any service ever does, close the tab. With reading + trading only, the worst-case scenario is bounded: your money physically cannot leave the exchange.

The safety checklist

• ✅ Enable only Reading and Futures trading (Binance) or Trade under Unified Trading (Bybit).
• ❌ Never enable Withdrawals or Transfers.
• 🔐 Turn on 2FA on your exchange account — Bybit even requires it before you can create keys.
• 💰 Keep a safety buffer: don't dedicate 100% of your futures wallet to bots.
• 🔄 Keys with unrestricted IP access expire (90 days on Binance, 3 months on Bybit) — recreating them regularly is a feature, not a bug.

How Vortoio stores your key

Your API key and secret are encrypted with AES-256-GCM the moment they reach our server and are never displayed again — not in the dashboard, not in logs, not even to you. The decrypted key exists only in memory, only at the moment an order is signed.

Step-by-step guides

We keep detailed, up-to-date instructions with every menu click for both exchanges in our FAQ: activating the futures account, creating the key with the right checkboxes, and connecting it to Vortoio in under five minutes.

Once the key is added, the dashboard shows your futures wallet balance — that is your confirmation that everything works. From there, launching the first bot takes one click and 50 USDT of available balance.