Most exchanges let you generate more than one kind of API key, and the permissions attached to that specific key — not the platform you connect it to, not what its marketing says — are what actually determine what can happen to your funds. This is the one setting worth understanding properly before connecting any automation tool, not just ZeroLoss.
The three permissions that matter
On most major exchanges, an API key can be granted some combination of three capabilities: read access, which lets a connected service view balances, open positions, and trade history; trade access, which lets it place and cancel orders; and withdraw access, which lets it move funds out of the account entirely. ZeroLoss only ever asks for read and trade. There is no field anywhere in our onboarding flow that even has a place to enter a withdrawal-enabled key — it's not a setting we ask you to leave off, it's a capability the product was never built to accept.
Why this is worth checking yourself, every time
Don't take any platform's word for what its key needs — check the permission screen on your exchange directly when you generate the key, and check it again periodically afterward. If a service ever asks you to enable withdrawal access "just in case," "for full functionality," or to "resolve an account issue," that's a legitimate reason to stop and ask why an execution-only automation service would need it. It shouldn't, and if the answer isn't satisfying, don't enable it. This applies as much to us as to any other platform — verifying independently is the entire point.
What a properly scoped key looks like in practice
On Binance, Bybit, BingX, and most other major exchanges, the API management screen shows explicit toggles for each permission type when you create a new key. A correctly configured ZeroLoss connection shows "Enable Reading" and "Enable Futures" or "Enable Spot & Margin Trading" switched on, and "Enable Withdrawals" switched off — usually grayed out or requiring an extra confirmation step specifically because exchanges know how consequential that toggle is. If you ever see a setup guide, anywhere, asking you to enable that toggle for an automation product, treat it as disqualifying.
Revoking access is entirely yours, at any time
Because the key lives on your exchange account and not inside ZeroLoss's systems, you can revoke or regenerate it whenever you want, directly through your exchange, independent of any action from us. There's no support ticket required to disconnect, no waiting period, no need to contact anyone — it's a setting you already control, the same way you'd control any other security setting on your own account. If you ever want automation to stop immediately, revoking the key is faster and more reliable than any in-app "pause" button could be.
The broader pattern this fits into
Trade-only API access is one piece of a wider non-custodial structure — it's the specific mechanism that makes the broader promise ("we never touch your funds") actually enforceable rather than just stated. See the full Non-custodial Disclaimer for how the pieces fit together, and our FAQ for exchange-specific setup notes.