Read-only API: connect your exchange without fund risk
The main fear with API keys is fund withdrawal. A properly scoped read-only key simply can't do that — it has no trade or withdraw rights, and the exchange enforces this server-side, not us.
Required permissions
DojoTrade only needs read access:
- Read trade history.
- View positions/balance for analytics context.
- No Trade, Withdraw, or Transfer rights — even a leaked key can't trade or move funds.
Where to create the key: Bybit, Binance, OKX, BingX, MEXC, and Bitget step by step
Pick your exchange below — we'll show where the API keys page lives, which boxes to tick, and which must stay off.
Pick your exchange
- 1
Open the API page
Log in to Bybit → avatar in the top-right corner → “API”. Your account needs 2FA enabled.
- 2
Create a new key
Click “Create New Key” and choose “System-generated API Keys”.
- 3
Name the key and pick the mode
Usage — “API Transaction”, name it e.g. dojotrade. Permission mode — “Read-Only”.
- 4
Tick the read scopes
Orders and Positions under Unified Trading plus Assets → Exchange History is enough. In Read-Only mode these are view-only — the key can't trade.
- 5
Decide on IP restriction
Without an IP whitelist the key expires in 90 days — Bybit deactivates it. With “Restrict to trusted IPs” it never expires, but you need a static IP.
- 6
Confirm and save the key pair
Pass the 2FA check. The API Secret is shown once — copy both values right away.
- 7
Paste into DojoTrade
Trades → “Connect exchange” → paste the API Key and Secret, pick 3, 6 or 12 months of history.
Enable
- Read-Only mode
- Unified Trading: Orders, Positions — view
- Assets: Exchange History — view
Leave off
- Trade — placing orders
- Withdraw — fund withdrawals
- Transfer — wallet transfers
Bybit auto-deactivates keys without an IP whitelist after 90 days — set a reminder to reissue.
What we never do
We don't place orders, change account settings, or initiate withdrawals. Keys only sync the trades you choose to import.
Keys are stored encrypted. Disconnect anytime in settings — syncing stops immediately.
Pre-connect checklist
Before pasting your key:
- Create a dedicated API key — not your trading key.
- Make sure the key mode is Read-Only and Trade/Withdraw/Transfer are off.
- Enable an IP whitelist if you have a static IP. On Bybit and BingX, a key without one expires in 90 days — set a reminder to reissue.
- For OKX and Bitget, save the Passphrase together with Key and Secret.
- The Secret is shown once — store the key pair in a password manager.
- Revoke the key on the exchange when you stop using the service.