Every time you connect an exchange account to a third-party tool, you do it through an API key rather than your login password. That key comes with a set of permissions, and those permissions decide exactly what the tool is allowed to do with your account. Understanding the difference between read-only, trade, and withdraw permissions is one of the simplest ways to protect your funds when experimenting with bots, dashboards, or monitoring apps.
The three permission levels, explained
At a glance:
| Permission | What a tool can do | Can it move funds out? | Risk if the key leaks |
|---|---|---|---|
| Read-only | see positions, balances, history | no | lowest |
| Trade | open, modify and close orders | no, but it can change your exposure | higher |
| Withdraw | send funds to an external address | yes | highest |
Read-only access lets a tool see your account data: open positions, balances, order history, margin usage. It cannot place orders, cancel orders, or move a single coin. In our example, if your account balance is $10,000 and you grant only read-only access, the tool can display that number and track changes over time, but it has no mechanical way to touch the $10,000 itself.
Trade permission adds the ability to open, modify, and close orders. A tool with trade access could, for example, place a limit order worth $500 margin or move a stop-loss on an open position. It still cannot withdraw funds, but it can change your exposure, so the risk profile is meaningfully higher than read-only.
Withdraw permission allows funds to leave the exchange entirely, to an external wallet or another account. This is the highest-risk permission by far. In our example, if a tool with withdraw rights were compromised, the entire $10,000 balance could theoretically be moved out, not just traded within the account.
Why 'least privilege' is the rule, not a suggestion
The principle of least privilege simply means: grant a tool the minimum access it needs to do its job, and nothing more. A position monitor that only needs to read your open trades and send alerts has no functional reason to hold trade or withdraw permission. If it never places orders or moves funds, giving it those extra permissions only expands what could go wrong if the key were ever leaked, misused, or the service itself were compromised — it doesn't add any benefit to you.
Think of it like a hypothetical example: you wouldn't hand a house-sitter the keys to your car and your safe just because they're watching your plants. The scope of access should match the scope of the task. Most exchanges let you create multiple API keys for the same account, each with its own permission set and often its own IP whitelist, which makes it easy to keep monitoring tools, journaling tools, and trading bots fully separated from one another.
A practical checklist before connecting any tool
- Check what the tool actually needs to do — does it only display data, or does it place orders?
- Create a dedicated API key for that specific tool rather than reusing one key everywhere.
- Disable withdraw permission unless you have a concrete, ongoing reason to enable it.
- Use an IP whitelist on the key when the exchange supports it.
- Review and delete unused keys periodically, especially after you stop using a tool.
- Keep withdrawal-capable keys protected by strong account security, including two-factor authentication.
Leveraged futures trading carries a high risk of loss regardless of how carefully API permissions are managed, so permission hygiene is about protecting access to your account, not about reducing market risk.
How this applies day to day
In practice, most of the tools traders use day to day only need to look at data: dashboards, tax trackers, and position monitors fall into this category. Tools that actively manage orders — like automated stop-loss adjustments — need trade permission, which is a different trust decision. Withdraw permission is rarely needed by any third-party tool and is worth treating with extra caution every time it's requested.
BitMe follows this approach by design: it connects to Binance USD-M futures, Bybit, OKX, and BloFin using a read-only key to monitor positions and send Telegram alerts, with an optional separate trade-enabled key, protected by two-factor authentication, only for users who want to close positions or adjust TP/SL from a chart. For more on how API key permissions work and how to check your own setup, see /exchange-api-key-safety.