Never enter a key into a generic auditor
A permission auditor should ask what capabilities are enabled, not request the API key value itself.
If a tool asks for a key before explaining permissions, storage, and revocation, treat that as a security concern.
Withdrawal permission is the severe line
For third-party tools, withdrawal permission is usually the most dangerous setting. It can turn a compromised key into direct fund movement.
Most portfolio, alert, and trading workflows should not need withdrawal permission.
Use narrow keys and IP allowlists
Create one key per tool, label it clearly, restrict IPs where available, and grant the minimum permission set needed for the workflow.
Avoid unrestricted IP access when the connected tool provides fixed outbound addresses or another safer pattern.
Rotate and revoke deliberately
Review connected keys regularly, rotate keys after incidents, and delete keys for tools that are no longer used.
Document the revocation path before an emergency, when decisions are calmer.
Decision rule
Use this guide as a checklist, not as financial advice. Confirm current platform terms, local eligibility, and risk limits before opening or funding any account.
Sources
- PartnerCrypto original API-permission guide.