Exchange API Key Permission Scope Disclosure Radar

Decision Matrix

Source Map

• Binance Developer Docs: Get API Key Permission (binance-api-restrictions)
• Coinbase Developer Documentation: Advanced Trade Portfolios (coinbase-advanced-portfolios)
• Coinbase Help: How to create an API key (coinbase-api-key-help)
• Kraken Support: How to create an API key (kraken-create-api-key)

Control Notes

1. Permission fields

Permission fields is the point where public documentation must become an operating rule. In this package, it means read, trade, transfer and withdrawal permissions have different failure and loss modes. The practical action is to record each permission as a separate inventory column. The unresolved edge is venue-specific naming, hidden dependency permissions and future permission schema changes, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

2. Portfolio boundary

Portfolio boundary is the point where public documentation must become an operating rule. In this package, it means portfolio-scoped keys can reduce blast radius when the venue supports them. The practical action is to link every key to the exact portfolio, account, subaccount or organization boundary. The unresolved edge is legacy key compatibility, OAuth access differences and private account structure, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

3. Network restriction

Network restriction is the point where public documentation must become an operating rule. In this package, it means IP whitelisting or restriction is a control only when the runtime host is stable. The practical action is to record IPs, host owner, NAT path and change procedure. The unresolved edge is dynamic IP churn, cloud failover and emergency access exceptions, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

4. Secret handling

Secret handling is the point where public documentation must become an operating rule. In this package, it means one-time display and passphrase rules make recovery different from ordinary passwords. The practical action is to store secrets outside chat and record only non-secret evidence. The unresolved edge is vendor logging, browser extension leakage and local machine compromise, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

5. Rotation trigger

Rotation trigger is the point where public documentation must become an operating rule. In this package, it means keys need a revocation and replacement rule before an incident happens. The practical action is to define rotation after role change, vendor change, host migration or suspected exposure. The unresolved edge is exchange support delays, stale bot configs and untracked copies, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

Known Unknowns

• venue-specific naming, hidden dependency permissions and future permission schema changes
• legacy key compatibility, OAuth access differences and private account structure
• dynamic IP churn, cloud failover and emergency access exceptions
• vendor logging, browser extension leakage and local machine compromise
• exchange support delays, stale bot configs and untracked copies

Practical Takeaway

The NexuAlpha radar signal is that exchange API-key safety depends on visible permission scope, portfolio or account boundary, IP controls and secret-handling rules. Binance publishes a permission readback endpoint, Coinbase documents portfolio-scoped API keys and permission categories, and Kraken documents API key creation as a permissioned account surface. The decision outcome is to make a key inventory with read, trade, transfer, withdrawal, portfolio, IP and rotation fields before connecting any automation. The article stops at the evidence boundary. It helps the reader decide what to inspect next without converting public documentation into a promise that a private account, wallet, API key, pool route, stablecoin balance, tokenized asset or policy framework will work under every future condition.