How to create a Binance API key for CashflowLoop

Use a dedicated key and protect the secret

Sign in to Binance directly by typing the address yourself or using a bookmark you trust. Verify the domain before entering your password, 2FA code, or API credentials. Do not create the key from a link in an unexpected email, chat message, or support request.

• Have Binance 2FA and the email account that receives Binance security prompts available.
• Create a key used only for CashflowLoop. Do not reuse a key shared with another bot, script, or person.
• Never paste the API secret into chat, email, a support ticket, a log, a URL, or an unverified site. Treat it like a password.
• Start with paper mode. Exchange credentials and automated trading carry real account and market risk.

Open Binance API Management

From your Binance account, open your profile or account settings and look for API Management. Binance may move this link or change the surrounding labels, so use the current account settings rather than relying on an old screenshot.

Screenshot 1 — Binance API Management with the Create API Key control visible; the account email and balances are not shown.

Select the option to create a new API key. If Binance offers multiple key types, choose the standard API key option intended for programmatic spot access, not a third-party OAuth or futures-only workflow.

Name and create a dedicated key

Use a name that makes the purpose obvious, such as CashflowLoop paper-to-live. A descriptive label helps you identify the right key months later when you audit or revoke access. Do not put the API key or secret in the label.

Complete Binance’s confirmation prompts. Depending on the account and current Binance flow, you may be asked for an email code, authenticator code, or other security confirmation.

When Binance shows the new key and secret, copy them carefully. The secret is commonly shown only once. Store it temporarily in a password manager or another private, access-controlled place while you finish the connection. Never save it in a public notes app, source repository, browser URL, screenshot, or shared document.

Set the smallest useful permission set

CashflowLoop needs enough permission to read account state and place or cancel spot orders, but it should not be able to move funds out of the account. In Binance’s permissions panel, use the following checklist:

Screenshot 2 — permissions panel with Read and Spot Trade enabled, and Withdrawals, Universal Transfer, and Futures unchecked.

Binance may use slightly different labels or group permissions under separate sections. The principle is unchanged: allow read access and the specific spot trading permission required for order placement; leave every money-movement and futures permission disabled.

Use IP restrictions only with a confirmed fixed IP

Some Binance key screens offer an IP access restriction. This can reduce the places from which a key can be used, but only when the service connecting to Binance supplies a trusted fixed outbound IP that you have independently confirmed.

CashflowLoop does not ask you to invent an IP address for this walkthrough. If CashflowLoop supplies a specific trusted fixed IP for your account, add only that value and verify it carefully. Otherwise leave the restriction unset rather than guessing and accidentally locking out validation or future access.

Connect the key in CashflowLoop

Open /bot and find the Binance API Key panel. Paste the public API key into API Key and the one-time secret into API Secret. Then select Connect Binance & Validate.

Binance API Key panel
API Key       → paste the key
API Secret    → paste the secret
               Connect Binance & Validate

The current CashflowLoop flow validates against the Binance testnet. A successful response shows only a masked API key; the secret is not echoed back. The browser clears the secret field immediately after submission, including after a validation attempt.

Paper mode is the default. Validation is not the same as authorising a live strategy: leave the bot in paper mode while you confirm the connection and understand the configuration. Only consider the Live toggle after the key validates and you have reviewed the pair, investment, grid count, and price range.

For the current implementation, credentials are runtime and in-memory state. They are not promised to persist across a restart, and this page does not promise persistence or encryption that the app does not implement. Disconnecting from /bot clears the runtime credentials from the app.

Confirm the key before you use it

1. The Binance key has a dedicated name and is not reused elsewhere.
2. Read and Spot Trade are enabled.
3. Withdrawals, Universal Transfer, and Futures are disabled.
4. You did not paste the secret into any chat, email, URL, log, repository, or unverified page.
5. You connected through the visible fields at /bot, saw validation succeed, and kept paper mode active first.

Revoke or narrow access

To stop future Binance API access, return to Binance API Management and find the dedicated CashflowLoop key. You can first edit it to disable Spot Trade, then delete the key when you are ready. Follow Binance’s confirmation flow, including any 2FA or email prompts.

Afterward, open /bot and use the Disconnect control. That clears the runtime credentials in CashflowLoop and returns the panel to its paste form. Deleting or narrowing the Binance key stops future API calls that depend on the removed permission; it does not reverse trades already placed or change your account balance.

If you are troubleshooting a key, revoke the old dedicated key and create a fresh one rather than repeatedly sharing or reusing a secret. If you think the secret was exposed, revoke it immediately in Binance and review account activity directly with Binance.

Risk disclosure