What an API Key Is
API stands for Application Programming Interface. An API key is a set of credentials that allows one piece of software to communicate with another on your behalf. In the context of crypto trading, your exchange API key allows QARI to send instructions to your exchange account: place a buy order, check your balance, cancel an order, and so on.
Think of it like a restricted access card. Your API key gives QARI access to specific functions on your account. It does not give access to your login, your email, or your withdrawal page. Those are determined by the permissions you set when creating the key.
Two parts of an API key
API Key
Like a username. Identifies your account to the exchange. Safe to share within the system (but treat it as sensitive).
API Secret
Like a password. Used to sign requests so the exchange knows they came from an authorised source. Never share this with anyone except the system you are authorising.
The Permission Model
When you create an API key on an exchange, you choose exactly what that key is allowed to do. The exchange enforces these permissions at the server level. A key without withdrawal permissions physically cannot withdraw funds, even if someone obtains the key.
Read
View account balances, trade history, open positions, and market data.
Spot Trading
Place buy and sell orders on spot markets. Required for QARI to trade.
Futures / Derivatives
Place orders on futures markets. QARI does not need this.
Withdraw
Move funds out of your exchange to external wallets.
What QARI Requests
QARI needs exactly two permissions to operate:
Read (required)
QARI needs to read your account balance to check if you have enough USDT to trade. It also reads open positions, trade history, and market data for the symbols it is scanning.
Spot Trading (required)
QARI needs to place limit and market orders to enter and exit trades on your behalf. Without this permission, it cannot trade.
That is all. Two permissions. Nothing else is needed or used.
What QARI Never Requests
QARI never needs and never asks for:
- Withdrawal permissions
- Futures or derivatives trading permissions
- Transfer between sub-accounts
- Universal transfer permissions
- Any wallet management permissions
If you are ever prompted to enable any of these permissions for QARI or any other trading service, do not proceed. A legitimate automated trading platform does not need withdrawal access.
How QARI Stores Your Key
Your API Secret is never stored in plaintext. When you paste it into the QARI dashboard, it is immediately encrypted using AES-256-GCM, one of the most robust encryption algorithms available.
Encrypted at rest
The encrypted ciphertext is what is stored in the database. Without the encryption key (which is stored separately from the database), the ciphertext is useless.
Decrypted in memory only
When QARI needs to place a trade, it decrypts the key in memory immediately before signing the request. The decrypted value is never written to disk, logs, or any storage.
Never returned to any client
Your API secret is never sent back to your browser or any other client application. The QARI dashboard shows only whether a key is connected, valid, or invalid. Never the key value itself.
Never logged
QARI's logging system is designed to never include API key values. Even in debug mode, the secret is masked before any logging occurs.
IP Whitelisting
IP whitelisting is an additional security layer that most exchanges support. When you whitelist an IP address on your API key, that key can only be used from requests originating from that specific IP address.
QARI strongly recommends whitelisting the QARI server IP when creating your API key. Even if someone obtained your API Key and Secret, they could not use them from any server other than QARI's.
QARI server to whitelist
api.qari.trade
Important: If you ever need to regenerate your API key (e.g., if you believe it has been compromised), go to your exchange API management page, delete the existing QARI key, create a new one with the same permissions and IP whitelist, and update it in your QARI dashboard settings.