Rotate and Revoke Broker API Keys: A Safety Checklist
Broker API key hygiene for algo traders: when to rotate keys, how to revoke access without breaking live bots, and what to check after any security scare.
Why rotation matters more than key strength
A broker API key is a long-lived credential. Unlike a password you type once, it sits in configuration, gets copied during setup, and keeps working silently for months. The risk is not that someone cracks it; the risk is that a copy of it ends up somewhere you forgot about.
Rotation means replacing an existing key with a fresh one and deleting the old. Revocation means killing a key outright. Both are routine maintenance, not emergency measures, and both take a few minutes if you plan for them.
When to rotate a key
You do not need a monthly calendar reminder. Rotate on events, not on a schedule you will ignore:
- You pasted the key into a note, chat, spreadsheet, or screenshot at any point.
- You changed devices, or a device you used during setup was lost, sold, or compromised.
- Someone else (a colleague, a "helper" in a Discord server) saw your setup screen.
- You stopped using a service or tool that held the key.
- The broker emailed you about a login from an unfamiliar location.
- You inherited the key from an old experiment and cannot remember where else it lives.
Never send an API secret over chat, email, or a support ticket, even to a service you trust. No legitimate platform will ask you to hand over a secret outside its own connection form. If you already did, treat that key as burned and rotate it.
How to rotate without breaking a live bot
The failure mode people hit is deleting the old key first, which leaves a running bot unable to place or manage orders mid-position. Sequence it properly instead.
- Check open positions. Decide whether you are comfortable with your bots being briefly unable to act. If a position is open with a stop resting at the broker, the stop still lives at the broker and is not affected.
- Pause your bots. Stop new signals before touching credentials.
- Create the new key first at the broker, with the same restricted permissions: trading enabled, withdrawals disabled, and an IP allowlist if your broker offers one. See our note on for the scopes that matter.
- Update the connection in algomax with the new key and confirm the account balance and positions read back correctly.
- Delete the old key at the broker. Not "disable for now", delete.
- Resume bots and watch the first trade or two land as expected.
The whole thing is a coffee break, not a project. The Binance flow is covered step by step in , and Alpaca and OANDA follow the same shape.
What revocation actually protects
Revoking at the broker is the only action that truly cuts access, because the key is issued and enforced there. Deleting a connection in any platform removes that platform's ability to use it, but a leaked copy elsewhere would still work.
If you only remember one rule: kill the key at the source, then clean up everywhere else.
This is also where non-custodial design does real work. Because algomax never holds your funds and bots trade only through your own broker keys, revoking at the broker instantly ends every automated action on that account. There is no separate withdrawal path to worry about, and your money never left the broker in the first place.
A five-minute quarterly audit
Once a quarter, open your broker's API settings and ask:
- Is every listed key still in use? Delete anything you cannot name.
- Does any key have withdrawal or transfer rights? Fix immediately.
- Is the IP allowlist still correct after any infrastructure change?
- Are your broker account and email protected by app-based two-factor authentication, not SMS?
- Do your notifications still reach you so unexpected trades get noticed fast? Our helps keep them readable.
Automation runs unattended, so the audit is the substitute for watching. Trading itself is risky enough without adding credential risk on top.
Key takeaways
- Rotate on events (leaks, device changes, stale keys), not on a schedule you will skip.
- Create the new key before deleting the old one, and pause bots during the swap.
- Only deleting the key at the broker truly revokes access.
- Audit your key list quarterly and remove anything you cannot account for.
Frequently asked questions
How often should I rotate my broker API keys?
There is no magic interval. Rotate whenever a key may have been exposed, when you change devices, or when you stop using a tool that held it, and run a short audit of your key list each quarter.
Will rotating a key cancel my open positions or stops?
No. Positions and any stop orders resting at the broker live at the broker and are unaffected by the key swap. Only your bot's ability to send new instructions pauses briefly.
Is removing the connection in algomax the same as revoking the key?
No. Removing the connection stops algomax from using the key, but the key still exists at the broker and any leaked copy would still work. Delete it at the broker to truly revoke it.
What should I do immediately if I think a key leaked?
Delete the key at the broker first, then check your account for unfamiliar orders or transfers, confirm withdrawal permissions were never enabled, and create a fresh restricted key afterwards.
Does algomax ever hold my funds?
No. algomax is non-custodial. Bots place orders through your own connected broker keys, so your funds stay in your broker account at all times.