KLINEO connection security and account controls
KLINEO connections use the credentials required by the selected exchange, with withdrawal permissions disabled. Funds used for connected-exchange trading remain at the exchange, but trade permissions can still create losses. Protect credentials, review the actual market and environment, and revoke keys at the exchange when they are no longer needed. No connection control removes exchange or trading risk.
- Withdrawals offOn every KLINEO exchange connection
- 4 credential typesAcross six supported exchanges
- No KLINEO 2FAEnrollment is not in the current build
- No audit claimedNo certification or completed audit
Check a key against the policy
Switch the permissions an exchange shows on its API key screen. The verdict quotes the published sentence that decides it.
API restrictions
Key label: KLINEO connection
Within KLINEO’s key policy
“Reading and the supported market’s trade permission only; withdrawals disabled.”
Read and trade access are powerful. A compromised trade credential can place unwanted orders or expose an account to losses even when withdrawal access is disabled.
Before you start
- Use only the official KLINEO and exchange sites.
- Never include API secrets, passphrases, seed phrases or primary wallet private keys in a support message.
Scope credentials to the task
Use separate keys you can identify and revoke. Enable only the permissions necessary for the feature and account you chose. Review available exchange IP restrictions and current official requirements. Do not weaken protection or enable withdrawals to work around a connection error.
Read and trade access are powerful. A compromised trade credential can place unwanted orders or expose an account to losses even when withdrawal access is disabled.
| Connection | Required credential type | Boundary |
|---|---|---|
| Binance, Bybit and TooBit | API key and secret. | Reading and the supported market’s trade permission only; withdrawals disabled. |
| KuCoin Classic | API key, secret, API passphrase and matching version. | Production only; keep withdrawals and transfers disabled. |
| BloFin | API key, secret and API passphrase. | Read and supported futures trade access; no KLINEO spot order placement. |
| Hyperliquid | Account wallet address and an approved API wallet key. | Never enter a seed phrase or primary wallet private key. |
Understand the controls that are available now
- Settings supports a password change using the current password and new password confirmation.
- KLINEO two-factor authentication enrollment is not available in the current build. A disabled “Coming soon” control is not active account protection.
- Protect the associated email and exchange accounts using their available security controls. Do not assume their settings enable KLINEO account 2FA.
- Exchange credentials are stored encrypted by the connection service. This statement is not a claim of external certification or an independent security audit.
- No independent security certification or completed audit is asserted by this page.
Use stop and revocation controls with their limits
- Inspect the relevant bot, workflow, open orders and exchange positions. Use the product’s Pause, Stop or Stop live control according to the actual state.
- Check the response and final order state. A delayed cancellation, failed request or still-open position requires follow-up at the exchange.
- Use Revoke in KLINEO Settings to retire a saved connection when it is no longer needed. Reconcile active work first if the action is blocked.
- Delete or revoke the API key at the exchange as well. For an approved API wallet, revoke its approval using the exchange’s official controls.
- Verify the exchange account directly. Retiring a connection, changing mode or enabling a kill switch is not proof that existing exposure is closed.
If you suspect a credential or account incident
Do not wait for a support reply to remove a known-exposed credential. KLINEO connection revocation and exchange key revocation are separate actions. Support does not need your exchange login password, seed phrase or primary wallet key.
- Use the exchange’s official site to revoke the affected API credential or API wallet approval promptly.
- Review open orders, positions and recent activity directly at the exchange; manage any exposure through its own controls.
- Change affected passwords and secure the email account if account access may also be compromised.
- Contact KLINEO with the approximate time, affected exchange and a non-secret description of the problem. Remove credentials and personal financial details from screenshots.
- Create a replacement scoped key only after resolving the issue, then verify the new connection and intended permissions.
Report a security concern or documentation error
Use the official contact page to report a suspected issue or incorrect security statement. Include enough non-secret context to reproduce the behavior. This page documents current product controls; the Terms, Privacy Policy and Risk Disclosure contain the governing service and risk information.