An API key acts like a technical credential. Treat it as a password with narrowly defined powers, and remove those powers as soon as they are no longer needed.
Use the least privilege
- Never enable withdrawals.
- Enable only the market types you use.
- Create a separate key for every service.
- Apply an IP allowlist when supported.
Do not expose the secret
Do not send keys through chat, email or screenshots. Never place a secret key in frontend JavaScript or a public repository. ELIXOAI forms should send credentials only over HTTPS.
If a key may be exposed
Revoke it on the exchange immediately, create a replacement and review recent account activity.
Review and rotate
- Review monthly Check active keys and remove unused integrations.
- Rotate deliberately Create and verify a replacement before revoking the old key.
- Watch activity Use exchange alerts for sign-ins, API changes and trades.