How to lock your crypto exchange API key to one IP (and why you should)

An API key with trading rights is a password to your money. Locking the key to one IP means a leaked key is useless from anywhere else. Here's how to do it without your bot locking itself out.

Last updated 29 October 2026 · 4 min read

You made an API key, pasted it into your bot, and it trades. Most exchanges then nag you to add an IP restriction, and many people skip it. Locking a crypto exchange API key to one IP takes two minutes. Keeping that IP from changing under you is the harder part. If your bot runs from home or a laptop, a static IP for exchange API keys solves that. First, why it matters.

Why exchanges push IP restrictions

API keys leak in boring ways. A config file pushed to a public repo. A screenshot in a group chat. A trading tool that stores keys carelessly. With no IP restriction, whoever has the key can use it from anywhere.

So exchanges are getting stricter. On Binance, an HMAC key without an IP restriction can only read data, and turning on withdrawal permission requires an IPv4 restriction. Binance also says unrestricted keys that sit inactive for 30 days may be deleted. Delta Exchange India won't give trading permission to a key without whitelisted IPs, according to its API docs, and WazirX recommends IP restrictions on every key. Some other exchanges expire or delete keys with no IP bound after a while.

The upshot: if you trade through an API, you'll end up binding the key to an IP sooner or later.

What IP binding protects you from, and what it doesn't

It protects you from a stolen key being used somewhere else. The exchange rejects the request because it didn't come from your address.

It doesn't protect you if the machine your bot runs on is compromised. Requests from that machine come from the trusted IP, so they go through. That's why the other half of the job is permissions: give the key only what the bot needs. A bot that trades doesn't need withdrawals.

Find the address your bot actually uses

Run this on the machine that runs the bot:

curl -4 https://ifconfig.co
curl -6 https://ifconfig.co

If both print an address, your connection is dual-stack, and that matters. Your bot might call the exchange over IPv4 one minute and IPv6 the next, depending on what the exchange's API supports. Whitelist only one and some calls fail at random.

We tested this from Mumbai on 29 October 2026. Binance, Bybit and WazirX's APIs didn't answer over IPv6 at all, so calls to them go out over IPv4. Delta Exchange, OKX and CoinDCX did answer over IPv6. Delta accepts both IPv4 and IPv6 in its whitelist, so you can add both or force your bot to one.

How to lock the API key to your IP

Each exchange's screens differ, but the steps are the same.

1. Open API management and create a new key, or edit the existing one.
2. Choose the option to restrict access to trusted IPs.
3. Paste the address from the step above. Add more than one if the bot runs in more than one place.
4. Set permissions: reading and trading only. Leave withdrawals off unless you truly need them.
5. Save, then make one test call from the bot.

One quirk: on some exchanges, CoinDCX among them, the binding uses the address of the device you create the key from. Create the key from the same network the bot will use.

Keep the IP from changing

A restriction is only as stable as the address behind it.

Running from home

Home broadband here is mostly dynamic. A power cut restarts the router, and with it you may get a new address. Many connections sit behind CGNAT and share a public IP with other customers. Not a good base for a key you've locked to one address.

A VPS with its own IP

Works well while you stay on that server. Move providers or rebuild the machine, and you're editing every key again.

A dedicated static IP the bot routes through

This is what TrueIP is for. You get a dedicated IPv4 in Mumbai, with its own proxy login. The bot sends its exchange traffic through it, so the key sees one address wherever the bot runs. In ccxt it's two properties:

import ccxt

ex = ccxt.binance({"apiKey": KEY, "secret": SECRET})
ex.httpsProxy = "http://USER:PASS@HOST:PORT"   # REST calls
ex.wssProxy = "http://USER:PASS@HOST:PORT"     # websocket streams

Set both. If you only set the REST proxy, your websocket streams still leave from your own connection. The traffic stays TLS encrypted, so we never see your key, secret or orders.

A note on what this isn't for

A fixed IP is for binding your key. It isn't a way to reach an exchange you're not allowed to use, or to get around an exchange's own rules. Use exchanges and accounts that are open to you in India, under their terms.

Quick checklist

• Run curl -4 and curl -6 against ifconfig.co on the bot's machine.
• Bind the key to the address the bot actually uses. Use IPv4 for Binance.
• Give the key trading permission only. No withdrawals unless you need them.
• Use one key per bot, so you can revoke one without stopping the rest.
• Put the bot on an address that won't change: a VPS you'll keep, or a static IP for your exchange API key.

Keep reading