Is it safe to give a trading platform my Binance API key?

It is safe to the exact extent of the permissions you grant, which is why the permissions screen matters more than the platform's reputation. A key with reading and trading enabled can place and cancel orders and see your balances — it cannot move funds off the exchange. A key with Enable Withdrawals can empty the account. Since no trading feature needs withdrawal permission, granting it converts a bounded risk into an unbounded one for nothing in return.

Why does my Binance API key return error -2015?

Because -2015 is a single code covering three unrelated faults: an invalid key, an IP that is not on the key's allow-list, or a missing permission for the action being attempted. It also appears when a testnet key is used against the live host or against Binance's other testnet. Check them in that order rather than regenerating the key, which is the common first response and usually not the problem.

Which IP address do I put in Binance's IP restriction?

The platform server's outbound address, not your own. Orders are signed and sent by the server that holds your encrypted key, so that is the address Binance sees. Allow-listing your own IP produces a key that works from nowhere. A platform that expects you to use the allow-list should show you the address to enter — and it should read it from the running server rather than hardcode it, because a stale address fails silently.

What is the difference between Binance's two testnets?

They are separate systems, not two views of one. testnet.binancefuture.com serves USD-M futures and testnet.binance.vision serves spot; each has its own account, its own play-money balance and its own API keys, and each rejects the other's keys as invalid. Both sign in with GitHub rather than your Binance credentials, and neither touches your real account.

I lost my API secret. Can I recover it?

No. Binance shows the secret once, at creation, and stores only a hash of it. There is no recovery flow. Delete the key and create a new one — and this time paste both values into their destination before you leave the page.

Should I use System generated or self-generated API keys?

System generated, for most third-party terminals. Self-generated issues an Ed25519 key pair, while the majority of platforms sign requests with the standard HMAC-SHA256 pair that System generated produces. A self-generated key on an HMAC platform is a valid Binance credential that simply will not authenticate, which is an unpleasant thing to debug because nothing appears to be wrong.

Connect Binance API Keys Safely

Connecting an exchange account to a third-party terminal is the step where most people either give away more authority than they meant to, or lock themselves out and blame the platform. Both are avoidable, and neither is really about the terminal — they are about a permissions screen on Binance that does not explain which of its switches a trading tool actually needs. This guide walks the whole path: what to turn on, what to leave off, what to copy before you navigate away, and how to read the one error message that hides three unrelated causes behind a single number.

Liquidation price calculatorBefore the first leveraged order, work out where the position would actually be liquidated.

Before anything else: two-factor authentication

Binance will not create an API key on an account without 2FA enabled. If you have not set up an authenticator app, do that first — otherwise you will reach the security-verification step and stop halfway, with a half-created key and no secret. This is also the right order for a second reason: an API key is a credential that can trade your balance, and putting one on an account protected only by a password is the wrong trade regardless of which platform you connect it to.

Create the key: choose System generated

On binance.com, open the profile menu, then Account, then API Management. Choose Create API and pick System generated rather than the self-generated option. The distinction matters: the self-generated path issues an Ed25519 key pair, and most terminals — including ours — sign requests with the standard HMAC-SHA256 key pair that System generated produces. Picking the wrong one produces a key that is valid on Binance and rejected everywhere else, which is a confusing failure to debug because nothing is technically broken. Give the key a label you will recognise in six months, then complete the security check.

Copy both values now — the secret appears once

Binance displays the API secret exactly one time, on the screen where it is created, and never again. There is no way to recover it. If you navigate away, close the tab, or lose the page to a session timeout, the key is unusable and your only option is to delete it and start over. Copy both the key and the secret into the terminal's fields immediately, before you touch the permissions screen — not after.

Permissions: reading, trading, and nothing else

Edit the key's restrictions and enable exactly two things: Enable Reading, which lets the terminal see your balances and positions, and the one trading permission that matches the market you intend to trade — Enable Spot & Margin Trading for spot, or Enable Futures for USD-M futures. Leave Enable Withdrawals switched off. This is not a cautious default; it is the correct setting. A trading terminal places orders, cancels orders and reads balances. There is no feature in that list which requires the ability to move funds out of your account, so a key with withdrawal permission adds a category of risk — a compromised platform, a leaked database, a rogue employee — in exchange for no capability at all. If a platform asks you to enable withdrawals, that request is the finding.

Enable Reading                 ON   — balances, positions, order status
Enable Spot & Margin Trading   ON   — only if you trade spot
Enable Futures                 ON   — only if you trade USD-M futures
Enable Withdrawals             OFF  — always. No trading feature needs it.

The IP allow-list, and the mistake everyone makes

Binance offers to restrict a key so that it only works from specific IP addresses, and you should use it. The mistake is which address to enter. Your orders are not sent by your browser — they are sent by the platform's server, which holds the encrypted key and signs the request. So the address to allow-list is the SERVER's outbound IP, not yours. Allow-listing your own address produces a key that fails from the platform and works from nothing, and the error you get is the least helpful one Binance issues.

Reading error -2015, which means three different things

APIError(code=-2015) is documented as 'Invalid API-key, IP, or permissions for action', and that comma-separated list is the whole problem: it is one code for three unrelated faults. It fires when the key is genuinely wrong, when the key is fine but the requesting IP is not on its allow-list, and when the key is fine and the IP is fine but the permission for that specific action was never granted. It also fires when a testnet key is presented to the live host, or to the other testnet. Work through them in that order — permissions, then allow-list, then which host the key was minted on — rather than assuming the key is bad and regenerating it, which is the instinctive response and the one that wastes the most time.

The two testnets, which are not one testnet

If you want to rehearse without risking money, Binance provides testnets — plural, and this trips up almost everyone. Futures testing lives at testnet.binancefuture.com and spot testing at testnet.binance.vision. They are separate systems with separate accounts, separate balances and separate API keys, and a key from one is rejected by the other exactly as if it were invalid. Both authenticate with a GitHub account rather than your Binance login, and neither has any connection to your real account or your real funds. Neither offers a permissions screen: a testnet key can trade the moment it exists. Practise there first, then repeat the process on the live exchange with the permissions discipline above.

futures testnet   testnet.binancefuture.com    GitHub login, play money
spot testnet      testnet.binance.vision       GitHub login, play money
live              binance.com                  real money, permissions matter

Keys are NOT interchangeable between these three.

What a good connection flow should do for you

One thing worth checking about any platform you connect a key to: does it verify the credential against the exchange before it stores it, and does it tell you what the exchange said? A form that accepts anything and shows a green tick has told you only that you typed something. A form that reports back the key's actual permissions, the account balance it can see, and the round-trip latency has proved the connection works — and, importantly, will show you if the key can withdraw, which is your last chance to catch a permission you did not mean to grant.

Summary

Enable 2FA, create a System generated key, and copy the secret before you leave the page — it is shown once and cannot be recovered. Grant Enable Reading plus the single trading permission that matches your market, and leave Enable Withdrawals off, because no trading feature requires it and a platform that asks for it is telling you something. If you use the IP allow-list, enter the platform SERVER's address rather than your own, since the server is what signs the request. And when something fails with -2015, remember it encodes three separate faults — bad key, disallowed IP, missing permission — plus the case where a key from one of Binance's two testnets was presented to the other.

How to Connect Your Binance API Keys to a Trading Terminal (Safely)