Skip to main content
An exchange API key grants the permissions configured at that exchange. Use a separate key for the ANSIO connection so its access can be reviewed or revoked independently.

​
Permissions

Enable only the permissions needed for the account views and trading functions you use. Keep withdrawals disabled. Use an exchange IP allowlist where it is supported and compatible with the connection.
A trade-enabled key can still lose funds through trading. Disabling withdrawals prevents that route of transfer; it does not make every permitted trade safe.
A key should belong to the intended exchange account or subaccount. Review that account in ANSIO before using a control that can place or cancel orders.

​
Keep secrets out of shared material

Do not put secret keys, passphrases or recovery credentials in Autopilot chat, Telegram messages, support tickets or documentation screenshots. When sharing an error, include the account name, venue, time and response text with credentials removed.

​
If a key may be exposed

Revoke the affected key at the exchange. Then review orders, fills, balances and positions directly. Removing a connection does not prove that resting orders were cancelled or that a Futures position was closed. Those are separate exchange states. Reconnect with a replacement key only after its account and permissions are confirmed. Review bot and Autopilot state before resuming work.

​
Team access

Use roles and account scope for people who need to view or manage an account. Sharing the underlying exchange secret is not required for a person to have an ANSIO view. Safe Settings saves configuration, not API secrets or exchange balances.