A calendar for retiring stale exchange API keys
API keys tend to outlive the projects they were created for. A test bot from last spring, a tracker you replaced, a script on an old laptop: each may still hold a working key with trading rights. The safest key is the one that no longer exists, but deleting keys only happens when someone remembers to do it. A calendar fixes that. This guide sets out a simple calendar for retiring stale API keys on Binance, OKX, Bybit and Bitget, with expiry dates chosen at creation, a quarterly review and clear rules for deletion. Menu names differ across platforms, so follow each official help centre.
Choose an end date at creation
Whenever you create a key, decide how long it should live and write that date in the key label and in your calendar. A test key might live a week; a key for a long-running tool might live three months before replacement. Some platforms apply their own expiry rules to keys without IP restrictions, so check the help centre and plan around them rather than being surprised by a key that suddenly stops working.
Quarterly review
Every three months, open the API page on each exchange and compare the list of active keys with your calendar entries. Any key without a matching entry is a warning sign: you have lost track of it, and it should be deleted unless you can identify exactly what uses it. For keys you keep, confirm that their permissions are still minimal, that withdrawals are disabled and that IP restrictions are in place where supported.
Retire cleanly
When a key reaches its end date, create a replacement only if the tool is still needed. Update the tool, test it and then delete the old key on the same day so that two keys never remain active for the same job. Remove the old secret from configuration files, password managers and backups as well. A key deleted on the exchange but still sitting in a file is harmless, but it creates confusion during later reviews.
After any doubt, retire early
If a device is lost, a server is compromised, a secret is pasted somewhere public or a tool provider reports a security incident, do not wait for the calendar. Delete the affected keys immediately, change your account password, review recent orders and contact official support through the app if you see activity you did not make. Early retirement is cheap; a leaked key with trading rights is not.
Risk boundary: BTC Pulse
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Write an end date into every new API key label and calendar
- Review all active keys on every exchange each quarter
- Delete any key you cannot match to a known tool
- Delete the old key on the same day its replacement works
- Retire keys immediately after any lost device or leak