Creating API keys and required permissions
Which permissions to give the API key so that SmartDOM works, and which not to give.
Required permissions
Section titled “Required permissions”| Permission | Needed | Why |
|---|---|---|
| Read (Read / Read-only) | Yes | Balance, positions, open orders. Without it the connection fails verification. |
| Trade (Trade / Spot & Margin Trading / Futures) | Yes | Placing and cancelling orders. Enable it for the markets you are going to trade: spot and/or futures. |
| Withdraw | No | Not needed by the terminal. A key with withdrawal permission is dangerous if leaked. |
| Transfer between accounts | No | Not used. |
Do not enable the withdrawal permission for the terminal’s key. If such a key leaks, funds can be withdrawn without your involvement.
IP restriction
Section titled “IP restriction”Exchanges let you bind a key to a list of IP addresses. This improves security, but if your address changes (home internet, mobile network, VPN), the terminal gets the error “IP address is not in the API key whitelist”. Options:
- do not enable the IP restriction if your address is not permanent;
- enable it and add the current address, then update the list on the exchange when it changes.
Passphrase
Section titled “Passphrase”OKX, Bitget and KuCoin ask you to make up an additional phrase when creating a key. It is entered into SmartDOM together with the key. It cannot be viewed on the exchange later, so save it right away. For the other exchanges the Passphrase field is not shown.
On KuCoin the key needs the General, Spot Trading and Futures Trading permissions. A trading key not bound to an IP address is disabled by the exchange after 30 days of inactivity.
General procedure on the exchange
Section titled “General procedure on the exchange”- Log in to the exchange and open the API management section (usually in the profile menu: “API Management”, “API keys”).
- Create a new key. Any name, for example “SmartDOM”.
- Tick the permissions: read and trade. Do not tick withdrawal.
- Pass the exchange’s confirmation (2FA, email).
- Copy the API Key and Secret Key. The Secret Key is shown once; afterwards it cannot be recovered, only a new key can be created.
- Paste the keys into SmartDOM: How API connection works.
Validity and limits
Section titled “Validity and limits”- On some exchanges a key without an IP binding is valid for a limited time; afterwards it has to be extended or recreated. Symptom: the connection worked and then started returning “Invalid API keys”.
- Do not use one key in several programs at the same time: they share the exchange’s request limit.