Reviewed guide | 2026-10-08
Restricting Bitget API keys to a fixed IP address
An API key that works from anywhere is far more useful to an attacker than one tied to your server. Why and how Bitget users can restrict API keys to a fixed IP address and what to do when the address changes.
Bitget | the reader's region | the reader's funding currency | referral terms and fee claims
When you create an API key on Bitget for a trading bot or a tracker, one of the most effective protections is an IP restriction. With it, the key only works when requests come from addresses you have listed, usually the server where your tool runs. If the key leaks through a misconfigured file, a compromised laptop or a careless paste, it is far less useful to whoever finds it. Many users skip this step because it seems technical. This guide explains it simply and covers what to do when your address changes. Follow the Bitget help centre for menu steps.
Find the address your tool uses
If your tool runs on a rented server or cloud machine, that machine normally has a fixed public IP address shown in the provider's dashboard. Note it down. If your tool runs on a home computer, your address may change from time to time, which makes IP restriction harder; in that case consider running the tool on a server with a fixed address, or keep permissions especially limited.
Add the restriction when creating the key
In the API key creation form, enter the IP address in the field for allowed addresses and enable only the permissions the tool needs. Leave withdrawal permission off. Save the secret in a password manager under a clear label. Test the tool to make sure requests from the server are accepted. If they are rejected, double-check the address rather than removing the restriction.
When the address changes
If you move the tool to a new server or your provider assigns a new address, create a new key restricted to the new address, update the tool, confirm it works and then delete the old key. Avoid simply widening the restriction to allow any address, even temporarily, because temporary settings have a habit of becoming permanent.
Review restricted keys regularly
Once a month, open the API management page and confirm that every key has an IP restriction, minimal permissions and a label you recognise. Delete keys for tools you no longer use. If you see unexpected orders, disable the related key immediately, change your account password and contact Bitget support through the app.
Risk boundary: Bitget Referral Terms Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Note the fixed public IP address of the server where your tool runs
- Enter that address as the only allowed IP when creating the key
- Leave withdrawal permission off for every trading or tracking key
- Create a new restricted key instead of widening access when the address changes
- Check every key monthly for an IP restriction and a recognisable label
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat.