Bitfinex API Key Security Guide: Grant Lending Permission Only
How should you configure API Key permissions before using a lending tool? This article walks you through "least-privilege" setup: enable only lending, disable withdrawals and trading, and make use of IP whitelisting and 2FA to minimize the risk of API exposure.
How secure your lending tool is depends largely on how you configure your API. This article shows you how to minimize the risk.
Why API Permissions Matter So Much
An API Key is the key that authorizes a tool to operate your account—but which doors that key can open is entirely up to you. The principle is simple: least privilege.
Enable Only Lending, Disable Withdrawals and Trading
When creating an API Key, enable only the funding (lending)-related permissions, and do not enable withdrawals. This way, even if the API is leaked, no one can withdraw your funds. If you're not using the feature to switch to higher-yield currencies, you don't need to enable trading permissions either.
IP Whitelisting and 2FA
If your exchange supports it, set up an IP whitelist so that only the tool's server IP can operate the account, and enable 2FA on your account. These two layers significantly reduce the risk of key exposure.
Review and Revoke Regularly
Periodically review the API Keys authorized on your exchange, and revoke any that are no longer in use. When switching tools, remember to revoke the old key as well.
Kindo only requires lending permission—once set up, you can automate lending with peace of mind. → Try it free for 14 days
Disclaimer: This article is for informational purposes only and does not constitute investment, financial, or tax advice, nor is it a solicitation. Cryptocurrency and lending involve risk; returns are variable and not guaranteed, and you may lose your principal. Lending rates are determined by market supply and demand, and past performance does not indicate future results. Please assess your own risk tolerance; consult a professional for tax matters.
