Blog
SecurityAugust 27, 202610 min

Read-only API: connect your exchange without fund risk

The main fear with API keys is fund withdrawal. A properly scoped read-only key simply can't do that — it has no trade or withdraw rights, and the exchange enforces this server-side, not us.

#API#Bybit#Binance#OKX#BingX#MEXC#Bitget#security

Required permissions

DojoTrade only needs read access:

  • Read trade history.
  • View positions/balance for analytics context.
  • No Trade, Withdraw, or Transfer rights — even a leaked key can't trade or move funds.

Where to create the key: Bybit, Binance, OKX, BingX, MEXC, and Bitget step by step

Pick your exchange below — we'll show where the API keys page lives, which boxes to tick, and which must stay off.

Pick your exchange

Bybit · APIOpen the API page
  1. 1

    Open the API page

    Log in to Bybit → avatar in the top-right corner → “API”. Your account needs 2FA enabled.

  2. 2

    Create a new key

    Click “Create New Key” and choose “System-generated API Keys”.

  3. 3

    Name the key and pick the mode

    Usage — “API Transaction”, name it e.g. dojotrade. Permission mode — “Read-Only”.

  4. 4

    Tick the read scopes

    Orders and Positions under Unified Trading plus Assets → Exchange History is enough. In Read-Only mode these are view-only — the key can't trade.

  5. 5

    Decide on IP restriction

    Without an IP whitelist the key expires in 90 days — Bybit deactivates it. With “Restrict to trusted IPs” it never expires, but you need a static IP.

  6. 6

    Confirm and save the key pair

    Pass the 2FA check. The API Secret is shown once — copy both values right away.

  7. 7

    Paste into DojoTrade

    Trades → “Connect exchange” → paste the API Key and Secret, pick 3, 6 or 12 months of history.

Enable

  • Read-Only mode
  • Unified Trading: Orders, Positions — view
  • Assets: Exchange History — view

Leave off

  • Trade — placing orders
  • Withdraw — fund withdrawals
  • Transfer — wallet transfers

Bybit auto-deactivates keys without an IP whitelist after 90 days — set a reminder to reissue.

What we never do

We don't place orders, change account settings, or initiate withdrawals. Keys only sync the trades you choose to import.

Keys are stored encrypted. Disconnect anytime in settings — syncing stops immediately.

Pre-connect checklist

Before pasting your key:

  • Create a dedicated API key — not your trading key.
  • Make sure the key mode is Read-Only and Trade/Withdraw/Transfer are off.
  • Enable an IP whitelist if you have a static IP. On Bybit and BingX, a key without one expires in 90 days — set a reminder to reissue.
  • For OKX and Bitget, save the Passphrase together with Key and Secret.
  • The Secret is shown once — store the key pair in a password manager.
  • Revoke the key on the exchange when you stop using the service.