Exchange API keys:
connect with clear limits.

Separate read, trade and withdrawal permissions

Exchanges expose different combinations of permissions. Read access is used to retrieve data such as balances and positions. Trading access permits placing and managing orders. Withdrawal permission is a separate capability and is not required by Apex OS. Check the exact permissions in your exchange's own account interface and documentation.

Do not assume that a key is safe merely because withdrawals are disabled. A key with trading permission can still create unwanted positions and losses. Review the scope, the account and any restrictions offered by your venue. Create a dedicated key for the integration so that you can identify and revoke it independently.

What happens when you connect Apex OS

Apex OS uses the API keys you connect to interact with your own exchange accounts. Credentials are sealed in a vault per account, and funds remain on the exchange. Market Data and Positions & Orders provide the venue-specific context you need before submitting an order.

Support for an exchange through ccxt does not mean that every market, order type or account mode is available to every user. Availability depends on the exchange, account permissions and jurisdiction. Confirm spot versus futures, settlement currency and the exchange's margin or position settings before enabling automation.

• Open the exchange website directly to create or manage the key.
• Review permissions and disable withdrawals.
• Check which exchange account or subaccount the key belongs to.
• Confirm the intended market and account mode in Apex OS.
• Use the exchange's revocation controls when you retire a connection.

Choose the mode before the budget

Shadow produces signals without submitting orders. Paper uses simulated capital with current order books. Live sends real orders to the connected account. Verify the selected mode for each strategy or automated system; do not infer it from another window or a historical result.

The Shadow and Paper workflow is a way to inspect behaviour before real execution. It is not a security audit or a guarantee that a live strategy will behave identically. Apex OS places live trading behind its trading PIN, with MFA and risk controls described on the platform page.

Understand budgets, loss limits and kill switches

A budget limits the capital assigned to an automated path. Position sizing controls individual exposure. Daily loss limits and drawdown controls can stop or restrict activity when their conditions are met. These serve different purposes: a trade-size cap does not replace an overall portfolio limit.

No software stop can guarantee an exit price. Fast markets, limited liquidity, exchange outages and rejected requests can affect execution. Review how your chosen automation reports its state and what you would do if the connection became unavailable. Read about Cortex Autopilot and portfolio automation for the product workflow.

Review and retire access deliberately

Keep an inventory of which keys belong to which integrations and accounts. Recheck permissions when you change venues, add futures or change how an automated system operates. If a key is no longer needed, revoke it at the exchange rather than relying on closing a browser tab.

Never send an API secret, recovery code or trading PIN through a contact form. For help, describe the exchange, the market type and the error message without including credentials. The Apex Infinity contact page is for access requests and questions, not for depositing funds or submitting secrets.

Explore the workspace before requesting access

The public live demo uses public market data and is read-only; it does not require your exchange keys. It lets you inspect the interface before deciding whether to request your own workspace.

Review Apex OS plans for the distinction between a manual desk, research, Shadow and Paper automation, and live automation. MKR Solutions in Rotterdam develops the software; see the company information and privacy policy.