How to manage API key permissions in Binance authentication settings?

Understanding API Key Permission Levels

1. Binance divides API permissions into distinct functional categories: read-only, spot trading, margin trading, and futures trading.

2. Read-only access permits retrieval of account balances, order history, market depth, and candlestick data without initiating any fund movement.

3. Spot trading permission enables placement, modification, and cancellation of orders on the spot exchange but excludes withdrawal capabilities by default.

4. Margin trading access requires separate activation and mandates completion of the Binance margin agreement before granting leverage-related endpoints.

5. Futures trading permission must be explicitly enabled and is only available after successful verification of futures trading eligibility on the user’s account.

Editing Active API Key Permissions

1. Navigate to the Binance website and log in using verified credentials.

2. Go to User Center → Security Settings → API Management.

3. Locate the target API key and click the Edit icon adjacent to its entry.

4. Toggle individual permission switches such as “Read Info”, “Trade”, “Margin”, and “Futures” according to current operational requirements.

5. Confirm changes with Google Authenticator code and wait for the system to reflect updated status within seconds.

Restricting Access via IP Whitelisting

1. Each API key supports binding to one or more IPv4 addresses through a strict whitelist mechanism.

2. Enter a single IP address like 203.0.113.45 or use CIDR notation such as 203.0.113.0/24 to define a subnet range.

3. Leaving the IP whitelist field empty disables all external requests regardless of permission settings.

4. Requests originating from non-whitelisted IPs return HTTP 401 error with message “API key does not exist or is not valid”.

5. Dynamic IP environments require periodic updates or integration with DNS-based resolution services to maintain continuity.

Sub-Account API Isolation Strategy

1. Sub-accounts operate under independent balance ledgers and cannot share API keys with the main account.

2. Create sub-accounts at https://www.binance.com/zh-CN/my/sub-account/account-management using unique email addresses.

3. Each sub-account has its own dedicated API management interface accessible only after completing two-factor authentication.

4. Assign specific trading permissions per sub-account to enforce role-based control across teams or strategies.

5. Disable unused sub-account APIs immediately upon termination of associated algorithmic processes.

Testing Permissions in Testnet Environment

1. Access the Binance testnet portal at https://testnet.binance.vision using main account credentials.

2. Generate a testnet-specific API key pair without requiring IP whitelisting or device binding.

3. Use the base URL https://testnet.binance.vision/api instead of production endpoints during validation.

4. Execute simulated trades and balance queries to verify that granted permissions behave identically to live conditions.

5. Monitor response codes such as 200 for success or -2015 for unauthorized actions to confirm correct configuration.

Frequently Asked Questions

Q1: Can I enable both spot and futures permissions on the same API key?Yes, but doing so increases exposure surface; Binance recommends maintaining separate keys for each domain.

Q2: What happens if I disable “Read Info” while keeping “Trade” enabled?The API will reject calls to /api/v3/account and similar endpoints, yet still accept order placement requests if sufficient balance exists.

Q3: Does changing permissions affect existing open orders?No, active orders remain unaffected; permission changes apply only to new requests made after the update takes effect.

Q4: Why does my API request return error code -2015 even after enabling trade permissions?This indicates either missing signature validation, expired timestamp, or mismatched secret key—verify HMAC-SHA256 implementation and clock synchronization.