How to create a Binance API key for Bitlot
· 3 min read · Bitlot Team
Bitlot connects to your Binance account through an API key. This guide shows you how to create one that can read and trade only, lock it to Bitlot's IP addresses, and link it. It takes about five minutes. On Binance, Bitlot supports spot and USDⓈ-M perpetual futures.
Why a trade-only key matters
An API key is a set of credentials that lets software act on your exchange account, limited to the permissions you tick when you create it. The safest key is the one that can do only what's needed.
Bitlot needs to see your balances and positions, and to place and close orders. It never needs to move money off the exchange, so:
- Never enable withdrawals. Bitlot rejects any key that can withdraw, and re-checks keys regularly. If withdrawal is switched on later, Bitlot stops using the key.
- Restrict the key to Bitlot's IPs. An IP-restricted key only works from the listed servers, so a copied key is useless anywhere else.
With a key like this, Bitlot never holds your trading funds and can never withdraw from your exchange account. Your funds stay on Binance, under your own login.
Binance offers system-generated (HMAC) keys and self-generated (Ed25519 or RSA) keys. Choose a system-generated key: you get an API key and a secret key to copy into Bitlot.
Step by step
In Binance, the API settings are under Account → API Management. Grant Enable Reading, Enable Spot & Margin Trading and Enable Futures, and leave Enable Withdrawals switched off.
- 1
In Binance, open Account → API Management and create a new system-generated API key.
- 2
Enable Reading, Spot & Margin Trading and Futures. Leave Withdrawals switched off; Bitlot rejects keys that can withdraw.
- 3
Restrict the key to trusted IPs and paste in every Bitlot IP listed under Settings → Venues & API keys in the app.
- 4
Copy the API key and secret into Bitlot under Settings → Venues & API keys → Binance.
You'll find the current list of Bitlot IP addresses under Settings → Venues & API keys in the app, in the card for linking a key. Paste in every address shown.
Check the connection
After you save the key, Bitlot checks it straight away. A green status means the key can read and trade, cannot withdraw and is reachable from Bitlot's servers. Your Binance balance then appears in the app.
Troubleshooting
"IP list incomplete" or the key can't connect. The key's IP restriction is missing one or more Bitlot addresses. Edit the key on Binance and add every IP listed under Settings → Venues & API keys, then re-check it in Bitlot. Exchanges sometimes take a minute to apply changes.
"Withdrawal enabled". The key has withdrawal permission, so Bitlot won't use it. Delete that key on Binance and create a new one with withdrawals switched off. Don't just untick the box on the old key: a fresh key is cleaner and its secret has never been exposed with withdrawal rights.
Futures permission missing. If Enable Futures is greyed out, open a USDⓈ-M futures account on Binance first (it only takes a quiz and a click), then edit the key and tick the box.
Invalid key or signature. Check that you copied the full API key and secret with no leading or trailing spaces. If in doubt, delete the key and create a new one.
Removing access
You're in control at every step. To cut Bitlot off immediately, delete the API key on Binance. You can also unlink the exchange in Bitlot under Settings → Venues & API keys. Open positions stay on your Binance account either way, and you can manage them there.