Before creating a key
Verify the product domain and operator, read current terms and security documentation, check incidents, enable phishing-resistant MFA where available, and create a dedicated exchange subaccount with a limited balance.
While configuring access
Grant read and spot-trade scopes only when needed. Disable withdrawals, transfers, futures and margin unless explicitly required. Apply an IP allowlist and separate keys by product and purpose.
Before live automation
Use paper trading, set conservative order and position limits, test stop and cancel behavior, verify the pair and quote currency, and confirm webhook secrets. Document how to disable the bot and revoke the key.
Ongoing and incident controls
Review active keys and sessions, update local deployments and monitor unexpected orders. On suspected compromise, stop automation, revoke at the exchange first, preserve logs and contact affected providers.
Related product research
These profiles illustrate different architectures and evidence limits discussed in this guide.
Sources
Require Multifactor Authentication — CISA, accessed August 19, 2026.
Coinbase Exchange API authentication — Coinbase Developer Platform, accessed August 19, 2026.
Security in Altrady — Altrady Support, accessed August 19, 2026.
Educational disclaimerThis guide is informational, not financial, investment, legal or security advice. Product and exchange controls change; verify current settings directly.