What Happens to Your Brokerage Credentials: API Key Scoping, Storage, and Verification
Your API credential is the entire security boundary between a trading tool and your money. Everything else is commentary. This is the operational manual: what each permission actually enables, why withdrawal access should never be granted to any tool, the uncomfortable reason a trade-only key is bounded rather than safe, and a step-by-step revocation drill for the day something looks wrong.