Skip to content

API Key Security#

Anboto executes on your own venue accounts through API keys you provide. This page covers the permissions those keys need, how to rotate or revoke them, and how Anboto stores and protects them.

What permissions should my API key have?#

Create your API keys with trading permission only — never grant withdrawal permission. Anboto is non-custodial and only needs to place and manage orders on your account; a trade-only key can never be used to move funds off the venue, even in the worst case.

  • Enable read and trade, for the market types you actually trade (spot, futures, or both).
  • Leave every other permission off — withdrawals, transfers, copy trading, NFT, and similar.
  • Restrict the key to Anboto's IP allowlist. This is required by most venues and is what makes a stolen key useless elsewhere. Your IPs are specific to your Anboto account and are shown on Settings → Linked Exchanges; see Connect Exchanges.

See Connect Exchanges for the per-venue setup steps.

Rotating or revoking a key#

Rotate a key on a schedule that suits your security policy, and revoke immediately if you suspect it was exposed.

  1. Cancel or let finish any live orders running on that venue account — a revoked key stops the algo mid-order.
  2. On the venue, create a replacement key with the same trade-only permissions and the same IP allowlist, or delete the key outright to revoke it.
  3. In Anboto, open Settings → Linked Exchanges, remove the old connection, and link the new credentials. Anboto validates them against the venue on save.
  4. Delete the superseded key on the venue side once the new connection validates.

Removing a connection in Anboto stops Anboto from using the key, but only deleting it on the venue guarantees it is dead.

How Anboto stores your keys#

Your API keys are encrypted and stored in HashiCorp Vault, chosen for its audited security model and because it integrates with Anboto's low-latency infrastructure without adding overhead on the trading path. For detail on Vault's threat model, see the official documentation.

Around that:

  • Private subnet (VPC) — Anboto's servers are not directly reachable from the internet, and only authorized systems and personnel can reach the infrastructure that handles keys.
  • Encryption in transit and at rest — for all data, not just credentials.
  • Continuous monitoring and auditing, on a redundant, high-availability architecture.

Why not keep my API key on my own machine?#

Running your own keys locally is workable, but it moves several problems onto you:

  • Endpoint risk — a lost or stolen machine, malware, or an unsecured network exposes the keys directly.
  • Ongoing responsibility — patching, encryption, and backups are yours to manage, indefinitely.
  • Latency and reliability — orders sent from a home or office connection to a venue on another continent add hundreds of milliseconds and inherit every hiccup of that link. Anboto's execution servers are colocated near the venues instead.
  • Capacity — algo execution places and cancels child orders continuously, which a desktop connection handles poorly under load.