# BloFin API key setup: which permissions to choose and how to connect safely

*What to tick, what to leave alone, and the mistakes that make a key stop working.*

Any terminal or bot that trades your BloFin account needs an API key. It lets software read your balance and place orders without your password. Set up properly, it can't withdraw your money. These steps use Central Command, the BloFin terminal I build, but the permission advice applies anywhere.

## The short version

- **Tick:** Read and Trade.
- **Never tick:** Withdraw.
- **Optional:** Transfer, which moves USDT between your own BloFin accounts, such as funding and futures.

## Option 1: connect in one click

If the platform offers BloFin's one-click connect, use it. You approve on BloFin and the key is created for you, so there's nothing to copy. On Central Command, a key made this way also renews itself.

## Option 2: create the key yourself

1. Open [BloFin's API Management page](https://blofin.com/account/apis) and choose **Create API Key**.
2. Choose a passphrase. You'll need it again in step 5, and it's the one you pick here, not your account password.
3. Tick **Read** and **Trade**. Add **Transfer** if you want the platform to move USDT between your own accounts. Don't tick withdrawal.
4. Leave the IP whitelist **empty** for Central Command, because our servers don't call from a fixed address. Other platforms may give you an address to whitelist, so check their instructions.
5. Copy the API key, secret and passphrase, and paste them into [Account settings](/go/blog-blofin-key?to=/account).

## Why a BloFin API key stops working

- **It expired.** A pasted key lasts 90 days on BloFin unless it's renewed. When it dies, your bot stops trading, so note the date or use one-click connect.
- **The passphrase is wrong.** It has to be the key's passphrase, not your login password.
- **An IP whitelist doesn't match.** If you added an address, BloFin refuses calls from anywhere else.
- **A sub-account key has Transfer on it.** BloFin doesn't allow Transfer on sub-accounts, so create that key with Read and Trade only.

## Is it safe?

A key without withdrawal permission can't send your funds off BloFin. It can still place trades, so a bad bot or a leaked key can lose money through trading.

- Never post your secret or passphrase anywhere, and that includes support chats.
- Delete keys you no longer use, in BloFin's API Management.
- Use a sub-account to limit what a bot can reach.
- Only connect platforms you trust. On Central Command, keys are stored on the server and every exchange call is signed there, so your browser never handles the secret.

## What you can do once it's connected

Trade from the [terminal](/go/blog-blofin-key?to=/dataterminal) with charts, risk-based sizing and take profit and stop loss on entry, or [build an agent](/go/blog-blofin-key?to=/agents/new) that follows your rules.

Central Command is free with a BloFin account opened through our link, or there's a 10-day free trial with no card. It earns a commission from BloFin when members trade.

---

*Disclosure: I build Central Command, which earns a commission from BloFin on members' trading. This article was drafted with AI assistance. It is not financial advice. Leveraged trading can lose all of your money.*