Is It Safe to Give a Trading Bot Your Exchange API Key? Permissions, IP Whitelists and Withdrawal Rights Explained

A trading platform that runs rules in your exchange account needs a way in, and on most crypto exchanges that way is an API key. The question people ask before pasting one is the right question: what can a platform do with it, and what can it never do? The short answer is that the key does exactly what its permissions say. A key with trading permission can read your balances and place orders. A key without withdrawal permission cannot move a coin or a dollar out of the account, no matter who holds it.

This guide explains the permission model, the IP whitelist that some exchanges require, what a leaked trading-only key could and could not do, how JorgAI stores keys, and how to check all of it yourself. It draws on what we saw building JorgAI's Crypto.com connection this month. It is education, not advice.

The three permissions, and the one that matters most

Exchanges split a key's rights into separate permissions you toggle when you create it. The names vary, the three categories do not:

• Read. Balances, positions, order history. Portfolio trackers and tax tools need only this.
• Trade. Place and cancel orders. An automated trading platform needs this; without it, every order is rejected.
• Withdraw. Send funds out of the account to an external address or bank. No trading platform needs this, and JorgAI never asks for it. Leave it off.

The withdraw toggle is the one that decides your exposure. With it off, the worst a stolen key can do is trade inside your account, where the money stays. With it on, a stolen key can empty the account. On Crypto.com, Alpaca and Gemini the permission is separate and off by default on new keys.

What the IP whitelist does

Crypto.com goes a step further: a key with trading permission only works from IP addresses you list on it. JorgAI sends every order from one fixed address, 32.195.173.11, so you add that address once when you create the key. The effect is that a copy of your key is useless from anywhere else. We confirmed the mechanism the hard way while testing: a key without the whitelist still answered balance reads normally, and every order came back with code 40101, "Authentication failure". The Crypto.com setup guide covers the exact steps.

Publishing that address is not a security risk, and it is worth understanding why. The address is where traffic leaves the platform, not a door into it; JorgAI's servers sit on private networks with no inbound path from that address. The whitelist is a restriction on your key, not on our servers. If anything, a whitelisted key is safer than an unrestricted one.

What a leaked trading-only key could do, honestly

Suppose a key with trading permission, no withdrawal permission and no whitelist got out. The holder could place buys and sells inside your account. They could not withdraw. The realistic abuse is churning: trading your balance into fees, or buying an illiquid coin at a bad price. That is a real cost and the reason to revoke a key the moment you suspect it, but it is a bounded one, and a whitelist removes it entirely for exchanges that offer one. A key with withdrawal permission has no such bound.

How JorgAI stores and uses keys

• Encrypted before storage. The key and secret are encrypted at the application layer before they are written to the database. They are decrypted in memory only at the moment a request to the exchange is signed.
• Never logged, never returned. No JorgAI screen, export or API response contains a stored key or secret. Support staff cannot see them either.
• Trading permission only. The connect screen tells you to leave withdrawal off, and the platform has no code path that moves funds.
• Checked, and revocable at any time. JorgAI reads each Crypto.com connection's balance a few times a day; if the exchange rejects the key, you get an in-app notice. Revoking the key in the exchange's API Management cuts the platform off instantly, and disconnecting in JorgAI deletes the stored key.

The security page lists the platform's controls, and connecting a trading bot to a brokerage safely covers the questions to ask any platform, not just this one.

A five-minute check before you paste any key

1. Confirm the permissions on the exchange side, not in the platform's marketing: open the key in API Management and look at the toggles.
2. Confirm withdrawal is off and, where the exchange offers it, that the whitelist has only the platform's published address.
3. Ask how the platform stores keys and whether it can show them back to you. The right answer is encrypted and never shown.
4. Fund the account with what you intend to trade, not with everything you own. The key's reach is the account's balance.
5. Know where the revoke button is before you need it.

If you would rather have your rules enforced for you, with stops, a daily loss brake and position caps applied inside the exchange account you already have, that is what JorgAI does. You can set them once with a trading-only key and the funds never leave the account.

Quick answers

Is it safe to give a trading bot my API key? It is as safe as the key's permissions. A key with trading permission and no withdrawal permission can trade inside your account but cannot move funds out. Never grant withdrawal permission to a trading platform.

Can JorgAI withdraw from my exchange account? No. JorgAI asks for trading permission only, has no code that moves funds, and on Crypto.com only works from one whitelisted address.

What is JorgAI's IP address for the Crypto.com whitelist? 32.195.173.11. It is the fixed address every JorgAI order leaves from. Add it to the key's IP whitelist in Crypto.com's API Management.

What happens if my key leaks? Revoke it in the exchange's API Management; the platform is cut off instantly. A trading-only key could at worst place trades inside the account; it could not withdraw.

How do I check what a key can do? Open it in the exchange's API Management and read the permission toggles. The exchange's record is the source of truth, not the platform's description.

Data: permission models from the API documentation of Crypto.com Exchange, Alpaca and Gemini as published in October 2026, and JorgAI's own test of the Crypto.com connection, October 15 to 17, 2026. Exchange names are trademarks of their owners; JorgAI is not affiliated with them. This article is education, not investment advice.