This guide provides general research criteria. It is not personal financial, legal or security advice.
Use the least privilege possible
A trading tool generally needs market data and trading permissions. Withdrawal, transfer and user-management permissions materially increase risk and should remain disabled.
Create a dedicated key
Do not reuse keys across services. Label each key, restrict it to known IP addresses where possible, and avoid giving a tool access to more exchange subaccounts than it needs.
Set a revocation routine
Know how to disable the key immediately. Review active keys regularly and revoke any key tied to an unused service or an unexplained login.
API safety does not remove market risk
Restricted permissions can reduce account-takeover exposure, but a bot with trading permission can still place losing trades. Position limits and independent monitoring remain necessary.
Use this in a real evaluation
Document each answer and its source. Mark unsupported statements as provider claims, set a review date, and treat material unknowns as unresolved risk. Our methodology explains the full evidence hierarchy.