How to enable IP address restriction on my Binance API keys?

Understanding IP Address Restriction

1. IP address restriction is a security layer that binds an API key to specific IPv4 addresses or CIDR ranges.

2. Requests originating from any IP not listed in the whitelist will be rejected with HTTP 401 Unauthorized status.

3. This mechanism prevents unauthorized use of leaked credentials even if the Secret Key is compromised.

4. The feature applies exclusively to REST and WebSocket API calls—not to web interface logins or mobile app sessions.

5. Binance enforces strict validation: empty fields, wildcard entries like 0.0.0.0/0, or malformed CIDR syntax trigger immediate configuration rejection.

Navigating the API Management Interface

1. Log into your Binance account using verified 2FA and navigate to User Center → Security → API Management.

2. Locate the target API key row and click the Edit button on the far right.

3. Scroll down to the IP Whitelist Settings section—this area remains hidden unless the key was created with whitelisting enabled.

4. Click the toggle switch labeled Enable IP Whitelist; doing so reveals the input field for IPv4 addresses.

5. Enter one or more comma-separated IPv4 addresses (e.g., 203.0.113.42, 198.51.100.0/24) without spaces before or after commas.

Validating Your IP Configuration

1. Use ipinfo.io or whatismyipaddress.com to confirm the public IPv4 address of your trading server or local machine.

2. If deploying on cloud infrastructure, retrieve the outbound NAT IP—not the private LAN address—from your provider’s console.

3. Avoid dynamic residential IPs; instead, configure a static IP or use a VPS with fixed egress routing.

4. After saving changes, test connectivity by calling GET /api/v3/time from the whitelisted host only.

5. A successful response confirms correct binding; failure indicates either misconfigured IP or DNS-based resolution bypassing the intended route.

Managing Multiple Deployment Environments

1. For development, staging, and production environments, create separate API keys—each with its own dedicated IP list.

2. Never reuse a single key across environments; cross-environment leakage undermines isolation guarantees.

3. When rotating keys, update the IP whitelist simultaneously—delayed synchronization creates temporary access gaps.

4. Monitor failed request logs via Binance’s API Activity History tab to detect unexpected source IPs attempting access.

5. Disable legacy keys immediately upon confirming new ones function correctly—do not maintain overlapping active keys longer than necessary.

Frequently Asked Questions

Q: Can I use IPv6 addresses in the Binance IP whitelist? No. Binance currently supports IPv4 addresses and CIDR notation only. IPv6 entries are ignored silently during validation.

Q: What happens if my server’s public IP changes while the whitelist is active? All API requests from the new IP will fail with error code -1015 until the updated address is manually added to the whitelist.

Q: Does enabling IP whitelisting affect WebSocket connections? Yes. WebSocket endpoints such as stream.binance.com:9443 enforce the same IP restrictions as REST endpoints.

Q: Is there a limit to how many IPs I can add to a single whitelist? Binance allows up to 20 distinct IPv4 addresses or CIDR blocks per API key. Exceeding this count triggers a “Too many IPs” error during save.