Crypto Trading Automation on Your Own Exchange Account

Connecting an automation platform to your exchange comes down to one act. You create an API key and paste it somewhere. Most people do it in about ninety seconds, ticking whatever boxes the setup guide shows, and never look at the key again.

That works until the key stops working, which on all three major exchanges it's designed to do eventually. Or until you find out what the boxes you ticked actually allowed.

Automating trades on your own exchange account means creating an API key that lets a platform read your balances and place orders, while your money stays in your exchange account the whole time. The key needs read and trade permissions for the markets you want to run, spot, perpetuals or both. It never needs withdrawal permission. And unless the key is bound to specific IP addresses, Binance, Bybit and OKX will all switch it off on their own.

What are you actually handing over?

A set of permissions. Not your account.

An API key isn't a login. It can't change your password, can't see your identity documents, and on a sensibly configured key, can't move a single coin off the exchange. It can do exactly what you enabled when you created it, and the exchange enforces that on every request.

That's what non-custodial means in practice. Your funds sit in your exchange account, under your name, the entire time. The platform never holds them and nothing is ever sent to it. What it holds is the ability to ask your exchange to place trades, and your exchange checks the key's permissions before it agrees.

The alternative model, where you deposit money into a trading platform's own wallet, makes the platform's security, solvency and honesty your problem. With your own exchange account and a key, the most a platform can do is bounded by what the key allows.

Which is why the boxes matter.

Which permissions does automation actually need?

Two. And one to leave off permanently.

Read lets the platform see balances, open positions and order history. Without it nothing works, because the platform can't know what you hold. Every exchange switches it on by default.

Trade lets the platform place, change and cancel orders. It splits by market, so you enable it for spot, for perpetuals, or both, depending on what you actually intend to run. A key with spot trading only can't touch your perpetuals, which is a useful fence if you only want automation in one place.

Withdrawal stays off. No trading automation needs to move money off an exchange. A key with withdrawal enabled can empty your account if it ever ends up in the wrong hands, and nothing a trading platform does justifies that. Binance treats it seriously enough that it won't let you enable withdrawal on a key at all until the key is restricted to specific IP addresses. If a setup guide tells you to switch it on, the guide is wrong.

The exchanges name these differently:

Labels as of September 2026. Exchanges rename these from time to time, but the four categories stay the same.

What happens if a key leaks?

Less than if withdrawal were on. More than nothing.

A leaked read-and-trade key can't take your money off the exchange. What it can do is trade with it. Someone holding a copy could buy an illiquid coin at a terrible price, or open a leveraged position built to lose, and your balance would pay for it. That's a real loss even though not one coin left your account.

This is the risk people underestimate with trade-only keys, and it's the reason the rest of this article exists.

If you ever suspect a key is out, delete it at the exchange. That's instant and total. Whatever held the key, platform or anyone else, loses access the same second, and your funds were never anywhere else to begin with.

Why do API keys stop working on their own?

Because the exchanges decided that a key usable from anywhere on the internet shouldn't live forever. All three expire unrestricted keys, and no two do it the same way.

The differences are the part that bites.

Binance runs on a clock, not on activity. An automation trading every day doesn't reset it. When the time's up, trading permission lapses whether the key was busy or idle. Sources disagree on the current figure, so check the key's status on your own API management page rather than trusting any number, including this one.

Bybit has a trap almost nobody expects. Change your Bybit account password, for any reason, and every unrestricted key on that account stops working seven days later. A sensible security step on your login quietly breaks your automation a week afterwards, long after you've forgotten you changed anything.

OKX is the most forgiving. A key in regular use stays alive, since any account request counts as activity. But a strategy that sits idle for a fortnight, waiting for conditions that don't arrive, can come back to find its key deleted.

In every case the key gives no warning. It just stops. Your strategy logs rejections, or goes quiet, and the first sign is a trade that didn't happen.

The same single step prevents all three.

How does IP whitelisting fix it?

You tell the exchange which internet addresses a key may be used from, and it refuses the key from anywhere else.

That does two things at once. It makes a leaked copy close to worthless, because it only works from the addresses you listed. And on all three exchanges it switches the automatic expiry off. A key bound to known addresses is treated as trustworthy enough to keep.

The practical catch is knowing which addresses to list. They have to come from the platform, because it's the platform's servers that use the key, not your computer. When you connect an exchange account to Vectorhelm, you're given the addresses to add. Bind them to the key and it stops expiring.

Whatever platform you use, ask this before connecting: which addresses do I whitelist? One that can't give you fixed addresses is one whose keys you'll be recreating every few months, usually after a missed trade tells you it's time.

One key per platform

Create a separate key for every tool that connects to your account, and label each one with where it's used.

Sharing a key between two platforms means you can't revoke one without breaking the other, and if a key leaks you can't tell which side it leaked from. It also muddies the one audit trail you have, since every order either platform places arrives under the same key.

Separate keys cost nothing. Each exchange allows dozens. Delete the ones you've stopped using, because an old key with trade permission on an account you still fund is a door you forgot you left open.

What catches people during setup

A handful of traps, one or two per exchange, worth knowing before you create the key rather than after.

Binance perpetuals. Open your futures account first, then create the key. A key created before the futures account existed can't be used for futures trading, and switching the permission on afterwards doesn't fix it. The answer is a new key.

OKX credentials. An OKX key comes in three parts, not two: the key, the secret, and a passphrase you choose when you create it. OKX can't recover the passphrase, so if you lose it you're starting again with a new key. OKX also requires at least $100 in assets on the account before it lets you create one.

Bybit balances. Your funds need to be in the Unified Trading Account, not the Funding account. A platform connected through the key sees the trading side, so money sitting in Funding looks like no money at all.

Each exchange's full setup gets its own walkthrough.

Spot or perpetuals: what changes?

The permission is the small difference. The risk is the big one.

Spot automation buys and sells what you own. The worst case is a coin you bought losing value. Perpetuals add leverage, liquidation and funding: a leveraged position can be closed by the exchange before your stop is ever reached, and holding a position costs or earns funding every few hours regardless of what price does.

So the same strategy is a different thing on each. On perpetuals the question isn't only whether the entries make sense. It's what happens to the whole account when three of them go wrong at once on leverage. That's where limits sitting above individual strategies earn their place, a daily loss ceiling on the entire account rather than a stop on each trade.

Why doesn't anything have to run on your computer?

Because an exchange account is reachable over the internet directly, and nothing of yours sits in the middle.

A platform holding your key talks to the exchange's servers from its own. Your laptop has no part in it. Close it, lose your connection, go to sleep, and the strategy keeps running and its limits keep enforcing, because the whole conversation happens between two sets of servers and neither of them is yours.

That's genuinely different from MetaTrader 5, where the terminal on your own machine or VPS is the only way into the account and has to stay awake. If you run MT5 as well, it's worth planning around: the crypto side needs nothing from you, the MT5 side needs a machine that never sleeps.

The honest limitation

Non-custodial doesn't mean no trust. It means a narrower kind.

With withdrawal off and the key bound to the platform's addresses, nobody else can use your key, and nobody, the platform included, can move your money off the exchange. What remains is that the platform itself can trade with your balance, inside the permissions you gave it. That's the entire point of the key, and it's also exactly what you're trusting: that the platform does what your strategy says and nothing else.

Nothing removes that trust completely. What narrows it is a record the platform can't touch. Every order your automation places appears in your exchange's own order history, and the exchange keeps that, not the platform. Compare it against what your strategy was supposed to do every so often. If the two ever disagree, the exchange's record is the true one.

Before you create the key

Decide which markets you're automating, spot, perpetuals or both, and enable trading for those only.

Leave withdrawal off. Not for now. Permanently.

Bind the key to the platform's IP addresses when you connect, so it doesn't expire and a copy is useless anywhere else.

Then set an account-level loss limit before the first strategy goes live, especially on perpetuals, where leverage turns a bad hour into a bad week faster than any single stop can catch it.

Vectorhelm connects Binance, Bybit and OKX, spot and perpetuals, with signals routed through limits at strategy and account level, and nothing running on your machine. It isn't open yet. Early access is here if you want it when it is.

Vectorhelm is execution software. It runs the rules you define on accounts you own and control. Nothing here is trading advice, and no automation setup prevents losses. Exchange rules change; verify against each exchange's own documentation before relying on anything here.