Every automated trading service asks for the same thing: an API key to your exchange account. The question is fair: what exactly are you handing over? The short answer is that a correctly created key lets a bot trade but not steal, and three settings decide which of the two it is.
What an API key is
An API key is a pair of strings (key and secret; OKX adds a passphrase) that identifies your account to the exchange's program interface. Each key carries its own set of permissions, chosen when you create it. The key does not reveal your password, does not give access to the web interface and can be revoked at any moment without touching the account.
The three settings that matter
1. No withdrawal permission. A trading bot needs to read balances and place orders. It never needs to withdraw. Leave Withdraw (and on Binance Enable Internal Transfer) switched off. A key without this right cannot move a single USDT out of the account, whoever holds it.
2. IP whitelist. Exchanges let you restrict a key to a list of IP addresses. With the restriction, a request signed with your key from any other computer is rejected. If the key leaks, the thief would also need to control the service's servers. EDVI publishes its addresses on every exchange page; paste all of them.
3. Only the permissions the service names. Futures trading needs Futures (Binance), Unified Trading (Bybit), Trade (OKX) or Perpetual Futures (BingX). Margin lending, spot trading, sub-account management: off, unless the service explains why it needs them.
What a bot can still do with a correct key
Honesty requires saying it: a key with trading rights can open positions, including bad ones, and close them at a loss. The risk you take with a bot is the trading risk of its strategy, not the risk of theft. That is why the strategy's rules, its public statistics and your risk multiplier matter more than the key itself. Read what is drawdown and how to read it before setting the multiplier.
Sub-accounts: an extra wall
All four exchanges supported by EDVI offer sub-accounts. A sub-account has its own balance, its own API keys and cannot touch the main account. Transfer only the trading deposit there and create the key inside the sub-account: the bot then physically cannot see the rest of your funds.
If a key leaks
- Delete the key on the exchange. Orders signed with it stop being accepted immediately.
- Check open positions and orders; close what you did not expect.
- Create a new key with the same restrictions and reconnect it. In EDVI this is Strategy settings → API key.
With the IP whitelist in place, step 1 is a precaution rather than a rescue: nobody outside the whitelisted servers could have used the key.
Checklist
- 2FA enabled on the exchange
- Key created for trading only, withdrawal off
- IP whitelist contains every address of the service
- Deposit in a sub-account if the exchange supports it
- Secret stored once, in a password manager, never in a chat
With these five points, giving a bot an API key is no more dangerous than the strategy you ask it to run.
