Connect your exchange

To let a bot trade for you, you give it an API key — a permission slip your exchange creates. It lets the bot place the trades the strategy calls for, and nothing else. Pick your exchange below for a 2-minute walkthrough.

The one rule that keeps you safe: never enable “Withdraw”.

Create the key with trading permission but withdrawals OFF. Then no one — not the bot, not us, not an attacker — can move money off your exchange.
CodeVaultEx is non-custodial: your funds stay in your exchange account. We never hold your money.
Your key is encrypted at rest and used only to place the strategy's trades. You can revoke it on your exchange anytime.
Where your exchange allows it, also IP-allowlist the key to our servers (we show the IP at connect time).

💡 Don't want to hand over a key at all? Choose Signals-only mode when you subscribe. The bot just tells you what it would trade and you place the orders yourself — no API key needed.

Crypto exchanges

🔑 OKX, KuCoin and Bitget also require an API passphrase that you choose when creating the key — save it and enter it in the passphrase field when you connect. Every other exchange needs only an API key + secret.

🪙 Coinbase (Advanced Trade)

Open coinbase.com → Settings → API (Advanced Trade / CDP keys) → Create API key.
Permissions: enable Trade and View. Leave Transfer / withdrawal off.
Signature algorithm: choose ECDSA (Ed25519 also works; pick ECDSA if unsure).
Copy the API key name and the private key (shown once).

You'll provide: API key name + private key.

🪙 Binance

Open Binance → API Management → Create API → System generated (HMAC).
Enable Enable Spot & Margin Trading; leave Enable Withdrawals and Universal Transfer off.
Tip: whitelist our IP — a key with no IP restriction expires after 90 days.
Copy the API Key and Secret Key.

You'll provide: API Key + Secret.

🪙 Binance.US

Go to binance.us → API Management → Create API → System generated.
Enable Enable Spot & Margin Trading; leave Enable Withdrawals off.
Copy the API Key and Secret Key (secret shown once).

You'll provide: API Key + Secret.

🪙 Kraken

Go to Kraken Pro → Settings → API → Create API key.
Tick: Query Funds, Query Open/Closed Orders & Trades, Create & Modify Orders, Cancel/Close Orders. Leave Withdraw Funds off.
Use a spot key (not a Futures key). Copy the API Key and Private Key.

You'll provide: API Key + Private Key.

🪙 OKX · passphrase

Open OKX → API → Create V5 API key (live, not Demo).
Permission: enable Trade; leave Withdraw off.
You set a passphrase here — save it; you'll enter it when connecting.
Copy the API Key, Secret, and passphrase.

You'll provide: API Key + Secret + passphrase.

🪙 Bybit

Open Bybit → API Management → Create New Key → System-generated, usage API Transaction.
Under Unified Trading enable Spot. Leave Withdrawal, Account/Subaccount Transfer off. (Read-only won't trade — the common mistake.)
No-IP keys expire after ~90 days. Copy the API Key and Secret.

You'll provide: API Key + Secret.

🪙 KuCoin · passphrase

Open KuCoin → API Management → Create API.
Enable General and Trade (Spot); leave Transfer (its withdrawal permission) off.
You set an API passphrase here (distinct from your login password) — save it.
Copy the API Key, Secret, and passphrase.

You'll provide: API Key + Secret + passphrase.

🪙 Gate.io

Open Gate.io → API Management → Create API Key (APIv4).
Enable Spot/Margin Trade; leave Withdraw off.
Copy the API Key and Secret.

You'll provide: API Key + Secret.

🪙 Bitget · passphrase

Open Bitget → API Keys → Create API Key → System-generated, Read-write.
Enable Trade (Spot); leave Withdraw off.
You set a passphrase here — save it.
Copy the API Key, Secret, and passphrase.

You'll provide: API Key + Secret + passphrase.

🪙 HTX (Huobi)

Open HTX → API Management → Create → System-Generated.
Enable Trade (+ Read); leave Withdraw off.
Copy the Access Key and Secret Key.

You'll provide: API Key + Secret.

🪙 MEXC

Open MEXC → API Management → Create API Key.
Enable Spot Trade (+ read); leave Withdraw off.
Copy the API Key and Secret.

You'll provide: API Key + Secret.

🪙 CoinEx

Open CoinEx → API Management → Create API.
Enable Trade; leave Withdraw off. (New keys take ~10–15 min to activate.)
Copy the Access ID and Secret Key.

You'll provide: API Key + Secret.

🪙 Gemini

Open gemini.com → Settings → API → create an account-scoped (Primary) key, Trader role.
Do not grant Fund Manager (that's withdrawals).
Since 2025 Gemini requires you to pick Unrestricted or a Trusted-IP allowlist — choose one. Copy the API Key and Secret (shown once).

You'll provide: API Key + Secret.

🪙 Bitstamp

Go to bitstamp.net → API access → New API key.
Enable Account balance, User transactions, Open orders, Buy/Sell market & limit orders, Cancel order. Leave the Withdrawal group off.
Activate the key from the confirmation email (it won't work until you do). Copy the API Key and Secret.

You'll provide: API Key + Secret.

🪙 Crypto.com Exchange

Open crypto.com Exchange → API Management → Create (2FA required).
Enable Can Trade; leave Can Withdraw off.
IP whitelist is mandatory when trading is enabled — add our server IP (shown at connect time) or trades are rejected. Copy the API Key and Secret.

You'll provide: API Key + Secret.

🪙 Bitfinex · not available to US persons

Open Bitfinex → API Keys → Create New Key.
Enable Orders: Create & cancel and Wallets: read; leave Withdraw off.
Copy the API Key and Secret. Bitfinex doesn't serve US customers.

You'll provide: API Key + Secret.

🪙 Upbit · static IP required · region-gated

Log in (PC web) → My Account → Open API → create a key.
Enable Make Orders (includes balance inquiry); leave Withdraw off.
Upbit requires a static IP allowlist for order keys — add our IP. Copy the Access Key and Secret Key. Not available to US/sanctioned regions; KYC/residency rules apply.

You'll provide: API Key + Secret.

🪙 Poloniex · not available to US persons

Open Poloniex → API keys → Create API key.
Enable Trading; leave Withdrawals off. Confirm via the emailed code.
Copy the API Key and Secret (shown once).

You'll provide: API Key + Secret.

🪙 BingX

Open BingX → API Management → Create API Key (2FA required).
Enable Spot Trading (and Perpetual if your bot trades futures); leave Withdraw off.
If you set an IP whitelist, add our server IP (shown at connect time). Copy the API Key and Secret (shown once).

You'll provide: API Key + Secret.

🪙 Phemex · derivatives

Open Phemex → API Management → Create New API.
Set the permission to Trade; leave Withdraw/Transfer off.
Bind an IP if prompted (add our IP), then copy the API ID (key) and Secret (shown once).

You'll provide: API Key + Secret.

🪙 Deribit · options & futures · advanced

Open Deribit → Account → API → Add new API key.
Give the key trade scope on the relevant currencies; leave withdraw off (keep account: read on).
Copy the Client ID (use as the API Key) and the Client Secret. Deribit is a derivatives venue (options/perps) — make sure your bot is built for it.

You'll provide: API Key (Client ID) + Secret.

Stocks, forex & prediction markets

📡 These venues are verification & signals-only today. We read your real fills to build a verified track record, and bots send you signals (you place the trades). Hands-off auto-execution for stocks/forex/prediction markets is rolling out — the crypto exchanges above already support full auto.

📈 Alpaca (US stocks)

Sign up at alpaca.markets and open your dashboard.
Use Paper Trading keys to test risk-free, or Live keys for real money.
Click Generate / View API Keys and copy the API Key ID and Secret Key.

You'll provide: API Key ID + Secret Key. Alpaca keys can't move cash out — withdrawals happen only via ACH in their web app.

💱 OANDA (forex)

Open a live (or free practice) account at oanda.com.
Go to Manage API Access and generate a personal access token.
Copy the token and your Account ID (looks like 001-001-1234567-001).

You'll provide: API token + Account ID.

📈 Tradier (US stocks)

Open a brokerage account at tradier.com and go to your dashboard's API Access.
Create an Access Token.
Copy the Access Token and your Account ID.

You'll provide: Access Token + Account ID.

🎲 Kalshi (prediction markets)

Sign in at kalshi.com and open your API / Account settings.
Create an API key — Kalshi gives you a Key ID and lets you download an RSA private key file (save it; you only get it once).
Provide the Key ID and the contents of the RSA private key.

You'll provide: Key ID + RSA private key.

📊 Interactive Brokers — verification today, live execution rolling out

In IBKR Client Portal → Settings → Account Settings → API → Flex Web Service: enable it and copy the token.
Create a Flex Query (Trade Confirmations / Activity) and note its Query ID.
Provide the Flex token + Query ID. This is read-only — it lets us verify your real statements. Hosted live execution for IBKR is being rolled out.

You'll provide: Flex token + Query ID (read-only).

Don't see your exchange? We support 100+ via ccxt — also live: MEXC, Gate.io, HTX, Bitfinex, BingX, Phemex, Deribit and more (same trade-on / withdraw-off rule). Pick “Other (100+ via ccxt)” when listing, or tell us. Wallet-based venues (Hyperliquid, Polymarket) use an on-chain wallet key rather than an exchange API key and aren't connectable yet. Questions? See the FAQ or message us from any page.