Exchange credential and access review

Exchange credentials should be reviewed as revocable capabilities, not permanent configuration. A trade-enabled key may create substantial loss even when withdrawals are disabled. A recurring review confirms that every key still has a named purpose, minimum permissions, a known owner and a tested route to revocation.

Inventory every access path

Compare platform records with the exchange account rather than assuming the two lists match. Include active and inactive API keys, subaccounts, allowed IP addresses, service identities and human administrator sessions. Identify unused or duplicate keys and revoke them at the exchange; deleting a stored platform record does not revoke venue-side access.

Verify least privilege and separation

Confirm withdrawals and transfers are disabled, and enable only the market permissions the bot actually uses. Use a separate key per service or environment, restrict source addresses where supported, and keep exchange login credentials and multi-factor authentication independent of the bot. Never put secrets in source control, logs, screenshots or support messages.

Rotate and revoke with evidence

Define rotation triggers such as suspected exposure, personnel changes, infrastructure changes or the end of a bot's use. Record creation, activation, last use, rotation and revocation events without recording the secret. Rehearse emergency revocation and verify that alerts reach someone who can use the exchange directly when the application is unavailable.

Operational takeaways

• Reconcile the platform inventory with keys and sessions shown by each exchange.
• Revoke unused access at the exchange and verify the result independently.
• Document owner, purpose, permissions, restrictions and review date for every key.
• Rotate after material changes and test the emergency process on a safe account.
• Investigate unexpected orders or access immediately; do not wait for the next review.

Access review reduces avoidable exposure but cannot make a credential or account breach-proof. It is not a guarantee against loss, an authorisation of a user's trading activity or a substitute for the exchange's current security requirements.