How to Create a Trade-Only KuCoin API Key (Step-by-Step)

A friend forwards you a screenshot late one night: a KuCoin account, six figures, drained to nothing in under an hour. Not a hack. Not a phishing email. A trading bot the account owner had connected months earlier and mostly forgotten about, one they’d given full account access to because narrowing the permissions down at setup felt like an extra step they didn’t need.

That entire failure mode disappears with a single setting. A KuCoin API key can be scoped so a connected bot can open and close trades and can never move a single unit of currency out of the account, the same convenience of automation, with the one permission that actually matters switched off. Here’s exactly how to create that key, the way AI Crypto Secrets and any properly built non-custodial bot expects it.

None of this requires technical background. It requires knowing which screen to visit, which boxes to check, and, more importantly, which one to leave empty.

What “trade-only” actually restricts

An API key isn’t one on-off switch. KuCoin breaks access down into a handful of separate permissions, and each one governs a different category of action: reading account and market data, placing spot trades, placing margin trades, placing futures trades, moving funds between sub-accounts, and withdrawing funds to an external address. A key can be scoped to any combination of these.

“Trade-only” describes a specific combination, not a special toggle KuCoin ships labeled that way. It means enabling the trading permission for whichever market the bot actually uses, futures, in this case, while leaving the withdrawal permission unchecked. The bot can submit and cancel orders inside the account. It cannot ask the exchange to send money anywhere else, because that instruction requires a permission the key was never given.

This is worth sitting with for a moment, because it’s the entire security model in one sentence: the key point isn’t which boxes get checked. It’s the one that stays empty.

Where this setting lives inside a KuCoin account

Every exchange buries this screen somewhere slightly different, so it’s worth knowing exactly where to look on KuCoin specifically. Once logged in, the account avatar in the top-right corner opens a dropdown menu, and API Management sits inside it, a separate area from general account settings, security settings, or verification status.

Before any key gets created, KuCoin expects two-factor authentication and a verified email already set up on the account. That’s not a hoop to jump through for its own sake. It’s the same layer of protection that later gates the key-creation step itself, and skipping it just means dealing with it a few screens later instead of now.

Naming the key and setting a passphrase

Inside API Management, a Create API button starts the process. KuCoin offers two paths here: linking a pre-approved third-party application, or creating a standalone API key for manual configuration. AI Crypto Secrets, like most independent trading software, uses the second path, standard API Trading.

From there, two fields need filling in before permissions even enter the picture: a name for the key, and a passphrase. The name is just a label, something recognizable later, like “AI Crypto Secrets,” so a year from now it’s obvious what the key is for and safe to revoke if needed. The passphrase is different. It functions as a second secret alongside the API key and secret key themselves, required every time the key authenticates a request. KuCoin shows it exactly once, at creation. Lose it, and there’s no forgot-passphrase link. The only fix is deleting the key and generating a new one.

The permissions screen, the one that actually matters

This is the step the rest of the process exists to protect. KuCoin presents each permission as its own checkbox: General (read-only account and market data), Spot Trading, Margin Trading, Futures Trading, and Transfer, which covers withdrawals and moving funds between accounts.

For a futures trend-following bot, Futures Trading gets checked, alongside General for basic read access. Spot and Margin stay off, since the bot never touches those markets. Transfer stays off regardless of which markets are enabled, that’s the checkbox from the opening story, the one that turns a trading tool into something that can empty an account. Leaving it unchecked doesn’t limit what the bot can do for its actual job. It only limits what happens if the key is ever compromised, which is the entire point.

IP whitelisting: optional, but worth understanding correctly

Underneath the permissions, KuCoin offers an IP whitelist field: a list of specific addresses allowed to use the key, with every other address rejected automatically. It’s optional for a trade-only key, but not irrelevant. Trading permissions on a key with no IP whitelist get automatically disabled after 30 days of inactivity, a quiet security default, not a bug, and one that occasionally confuses people who set up a bot, stepped away for a month, and came back to find trading paused.

Withdrawal permission works differently: KuCoin requires an IP whitelist before it will even allow that permission to be enabled at all. It’s not relevant here, since trade-only means that box was never checked in the first place, but it’s a useful data point about how seriously the exchange itself treats that particular permission.

If the bot runs from a known, fixed server address, whitelisting that address adds a second lock on top of the first. If it doesn’t, or the address isn’t known in advance, leaving the field open is still safe, the door that actually matters, withdrawal, was closed several steps ago, and an IP whitelist wouldn’t have added anything to that specific protection anyway.

KuCoin double-checks before the key goes live

Clicking confirm doesn’t finish the job by itself. KuCoin asks for a trading password, an email verification code, and a code from an authenticator app before the key actually gets created. It can feel like friction in the moment, but it’s doing exactly what it should: making sure the person creating a new key with trading access is the account owner, not someone who managed to get into an open session or a stolen password alone. A password by itself has never been enough to gate something this sensitive, and KuCoin doesn’t treat it as though it were.

Getting the key into AI Crypto Secrets

Once confirmed, KuCoin displays the API key, the secret key, and the passphrase together, the only time the secret key appears in full. All three get copied into the AI Crypto Secrets Dashboard, in the fields set aside for exactly this. From that point on, funds never leave the KuCoin account. They sit there the entire time, the same as if the account holder were placing every trade manually, while the bot is only ever permitted to open and close positions inside it.

Turning it off is just as simple

Nothing about this arrangement requires trusting a company to eventually let go. Access can be revoked at any moment, directly from KuCoin’s own API Management screen, by deleting or restricting the key, no support ticket, no waiting on anyone else’s process. The moment the key is gone, so is the bot’s ability to do anything on the account at all.

What a trade-only key doesn’t protect against

Scoping the key this tightly removes exactly one category of risk: the risk that whoever holds the key can move funds out of the account. It doesn’t touch the other kind of risk at all, the ordinary risk of trading crypto futures with leverage, where losses are a normal, expected part of any systematic strategy, trade-only key or not. For the fuller picture of what non-custodial actually changes and what it leaves untouched, that distinction gets its own treatment. The same balance applies here: a correctly scoped API key is a real, meaningful safeguard, not a substitute for understanding the risk involved before connecting an account.

None of this takes longer than setting up an account on nearly any other platform: a handful of screens, a passphrase written down somewhere safe, and one checkbox deliberately left blank. That last part is the whole security model, and it’s the same one AI Crypto Secrets is built around from the first connection onward. See current pricing to get started.

The same trade-only logic applies on Bybit, too

AI Crypto Secrets connects to both KuCoin and Bybit, and this walkthrough focuses on KuCoin specifically because its screen is the one most readers ask about by name. The underlying principle carries over exactly: Bybit’s own API management area breaks permissions down into the same rough categories, contract trading, wallet transfers, withdrawals, and a trade-only key there means the same thing it means here. Enable order placement for the market being traded, leave anything resembling a transfer or withdrawal permission unchecked.

The screens look different. The exchange-specific menu names differ. The security model underneath does not. Whichever exchange an account lives on, the question worth asking before connecting anything is the same one: can this key move money out, or only trade with what’s already there?

One habit worth building alongside this

A trade-only key solves the account-drain problem, but it doesn’t solve the problem of forgetting the key exists. Most people who eventually lose track of an API key aren’t careless about permissions, they’re careless about memory: a passphrase saved in a random notes app, a key created for a tool tried once and never removed, an old bot connection that quietly outlives the reason it was set up.

A password manager fixes the storage half of that. Checking the API Management screen every so often fixes the other half, a quick glance at which keys exist, when each one was last used, and whether every single one is still doing a job worth doing. Anything unrecognized or unused gets deleted on the spot. It costs a minute and closes the gap that trade-only permissions were never designed to close in the first place.

None of this is unique to trading bots. Any service that asks for an API key deserves the same two questions: what can this actually do, and what happens if it falls into the wrong hands. A trade-only KuCoin key is simply what the honest answer looks like for a non-custodial trading strategy specifically, built so the second question has a boring, reassuring answer instead of an expensive one.