Restrict IP addresses

Always whitelist the IPs that will access the API. Never leave IP restrictions empty in production.

Use minimal permissions

Only enable permissions your application needs. Separate read-only and trading keys.

Never share your secret

Your API secret is shown only once at creation. Store it in a secure vault, never in source code.

Rotate keys regularly

Create new keys periodically and decommission old ones to limit the impact of a compromised key.

Monitor API activity

Review your API usage logs frequently for unexpected requests or patterns.

Use environment variables

Store API keys in environment variables or secrets managers, never hard-code them in your application.