Setting API Key IP Allowlists for Safer Exchange Automation

An API key is a credential that lets software act on your account without you typing a password each time. That convenience is exactly why an unrestricted key is dangerous: if it leaks through a copied file, a compromised script or a shared log, anyone holding it can attempt the same actions your automation performs. An IP allowlist narrows that exposure by binding the key to a set of addresses you control, so requests from anywhere else are refused. This guide walks through preparing your addresses, creating or editing a key in Bybit account settings, verifying that the restriction actually works, and building a routine that keeps the allowlist accurate as your infrastructure changes. It is written for readers who already run or plan to run automation and want the credential side handled deliberately rather than by default.

Why an unrestricted API key is a standing risk

When you create a key without restrictions, the key itself becomes the only thing standing between an outsider and your account permissions. Keys are frequently exposed in ways their owners never notice: pasted into a chat while debugging, committed to a repository, printed in a log file, or stored on a machine that is later compromised. Because API keys do not require a second factor at request time, a leaked key can be replayed silently and repeatedly.

An IP allowlist changes the shape of that risk. Even if the secret leaks, a request originating from an address outside your approved list should be rejected by the platform before it reaches your balances or positions. This does not make a key harmless, and it is not a substitute for good secret handling, but it removes the most common path from a leaked string to an unauthorised action.

The trade-off is operational: an allowlist that is out of date will block your own automation, and a list that is too broad defeats the purpose. Treat the allowlist as something you design and maintain, not something you set once and forget.

Prepare your addresses and permissions before you start

Before touching any key settings, write down the exact public IP addresses your automation will use. If your scripts run on a rented server, the provider's control panel shows the public address; if they run at home, remember that many consumer connections rotate addresses, which will break a strict allowlist. For dynamic connections, consider a stable egress address you control rather than guessing.

Decide the permission scope at the same time. A key that can withdraw is far more consequential than one limited to reading balances or placing orders, so keep automation keys as narrow as the strategy allows and consider separate keys for separate jobs. Check the current permission options and any restrictions on them in the account settings area of the help centre, since the available toggles and their labels are described there.

Finally, confirm where the key will be stored. An environment variable or a secrets manager is preferable to a plain text file inside a project folder. If you cannot describe how the secret is protected on the machine, fix that before creating the key.

Creating or editing the key with an IP restriction

Open the API management section of your Bybit account and start a new key, or select an existing key to edit. During creation you will typically choose a key name, set permissions, and reach a field for IP restrictions. Enter the addresses you prepared, one per entry where the interface allows multiple, and save. The exact field name, the maximum number of entries, and whether edits take effect immediately are details to confirm on the page itself rather than assume.

If you are editing a live key, expect a short interruption: automation using that key may fail until the new restriction is saved and propagated. Schedule the change for a quiet period and note the time you made it. Some interfaces let you restrict a key after creation, but if the option is missing, create a replacement key, update your software, then delete the old one.

Never paste the secret into a browser field that is not the exchange's own settings page, and never share it in a support chat, forum or screenshot. If you suspect the secret was exposed at any point during setup, delete the key and start again rather than trying to patch around it.

Verify the restriction and keep it current

After saving, test from an address you did not allow and confirm the request is rejected, then test from an allowed address and confirm it succeeds. A rejection message that mentions IP or permission is the signal you want; a successful request from an unlisted address means the restriction is not active and you should stop and recheck the settings. Record the date, the key name, the allowed addresses and the outcome of both tests in a simple log.

Set a review rhythm. Revisit the allowlist whenever you change hosting, add a second machine, or move a script, and remove addresses you no longer use. If a key is no longer needed, delete it instead of leaving it dormant. Also review the key's permissions at the same time, because scope creep is common when a key is reused for a new task.

For anything involving fees or trading costs tied to your automation, consult the official fee page rather than relying on memory, and record what you find alongside your key log so future changes are easy to compare. The help centre remains the place to check how IP restrictions, permissions and key deletion behave if a message in your software does not match what you expected.

Risk boundary: Bybit Independent Review

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• List every public IP address your automation uses and confirm none of them rotate unexpectedly before creating the key.
• Set the narrowest permission scope the task needs, and keep withdrawal rights off automation keys unless there is a documented reason.
• Enter the addresses in the API key's IP restriction field and save, noting the exact time of the change.
• Test one request from an unlisted address and one from a listed address, and confirm the first is rejected.
• Store the secret in an environment variable or secrets manager, never in a shared file, chat or screenshot.
• Log the key name, allowed addresses, permissions and review date, and delete keys that are no longer in use.