Binance trading bot setup questions, answered from Binance's own docs on API key permissions and order limits

2026-10-14

After installing a trading bot and opening it for the first time, two empty fields usually come up first. One is for the API key and the other for the secret key. On Binance's API management screen, each permission has its own checkbox, and bot manuals disagree about which ones to tick.

This post answers the questions that come up in front of that screen, using what Binance's support center and developer docs say. It does not recommend any bot and says nothing about returns.

1.Which permissions should be ticked when creating the API key?

A trading bot does two jobs. It reads balances and prices, and it places and cancels orders.

So the permissions it needs are reading and trading. A bot that only buys and sells spot does not need the futures permission. Binance support notes that a key created before the futures account was opened cannot have the futures permission turned on (creating API keys on Binance).

API key: the name tag a program uses to reach the exchange. The secret key signs requests to prove it.

2.Is it fine to leave the withdrawal permission on?

A bot that places orders has no reason to withdraw. If the key leaks while withdrawals are off, that key cannot send coins to another address.

Binance does not open withdrawals easily either. Its support page says an IP address restriction is mandatory before the withdrawal permission can be turned on.

If a bot asks for the withdrawal permission, ask why before anything else.

3.What happens without an IP restriction?

An HMAC key generated by Binance cannot enable any permission beyond reading when it has no IP restriction. The support page says this has applied since 30 January 2023.

To trade with the key there are three routes. Register an IP address, use a self-generated Ed25519 or RSA key, or turn off the default security controls.

When the bot runs on a home PC, register the outgoing IP address of that PC. If the internet provider changes the address, the key stops working, so check this first when orders suddenly stop going through. Turning off the security controls means one fewer safeguard if the key ever leaks.

4.What happens if the bot sends orders too often?

Binance sets separate limits on requests and on orders. These are the values from its public exchange rules, read on 12 October (exchange info).

• Request weight: 6,000 per minute
• Orders: 100 per 10 seconds, 200,000 per day
• Open orders per symbol: 200 for BTCUSDT, of which 5 conditional orders
• Minimum order value: 5 USDT for BTCUSDT

Request weight: a score per request. Heavy queries score higher, so they fill the limit faster.

100 per 10 seconds is 10 per second on average. 200,000 per day divided by the 86,400 seconds in a day is about 2.3 per second (our arithmetic). Short bursts are fine, but a steady pace all day hits the daily cap first.

Going over a limit returns status code 429. The bot should then wait the number of seconds in the Retry-After header. Sending more after a 429 brings a 418 and an automatic IP ban, and the limits page says repeat bans scale from 2 minutes to 3 days (Binance API limits).

Request limits are counted per IP address. Two bots on one PC share the same allowance even with separate API keys. Open orders, on the other hand, are counted per account.

The PC clock causes trouble about as often as the limits. Orders and account queries are signed requests, and each carries the time it was sent. A request more than 1 second ahead of Binance's server time is rejected, and the default tolerance is 5,000 ms (request security).

A Windows clock that drifts by a few seconds can get every order rejected. Turning on automatic time sync in settings is the simplest fix.

The same page strongly recommends Ed25519 keys, the self-generated type mentioned in question 3.

5.Where can the bot be tested before real money goes in?

Binance runs a Spot Test Network. Keys are created after logging in with GitHub, and all funds there are virtual. It resets about once a month without notice, so keep records elsewhere (Spot Test Network).

What to check on the testnet is whether orders go in and get cancelled properly, and whether the bot backs off after a 429. Profit figures there differ from the real market, so they are not a benchmark.

Trading fees are a cost the testnet does not show. A monthly cost worked out by number of trades at the 0.1% spot rate is in building an auto trading program. Terms of use differ by country of residence, so read those too.

Hiddenpick is a Windows program that keeps on its server the betting rules that pick owners do not make public, and runs them as they are on the PC of the person who received them through a referral code. It currently runs on Evolution live baccarat at Stake (stake.com). How automated betting works in baccarat is in the baccarat bot guide. We are recruiting national pickster representatives, and those selected receive benefits worth $12,000, a one-year pass (apply at hiddenpick.my/pickster).