Use minimum API permissions
Public market data usually needs no user key. If a semi-automated workflow uses a trading API, create a separate key restricted to trading.
- never enable withdrawal permission;
- apply an IP allowlist when supported;
- do not reuse keys across services;
- revoke keys that are no longer needed.
Users authorize their own transfers
MatrixLink should not have withdrawal access. Users verify the address, network, memo or tag, and submit transfers directly through the venue.
Updated: 2026-07-18
Frequently asked questions
Is an API key required to view opportunities?
Public market data generally does not need a user key; specific app features may have separate requirements.
Should withdrawal access be enabled for automation?
No. MatrixLink does not require it, and enabling it materially increases the impact of key compromise.