API key
An exchange API key lets software act on your account with the permissions you choose. Definition, the permissions that matter and how to keep keys safe.
Definition
A credential from your exchange that lets software read your account or place orders on it, limited to the permissions you choose when you create it.
An API key is how a trading app connects to your exchange account without your password. You create it on the exchange, choose what it may do, and paste it, with its secret, into the app. The exchange then accepts requests signed with that key, within those permissions.
Example
On Kraken you might create a key that can query funds, query orders, and create and cancel orders, with Withdraw Funds left off. An agent using that key can check your balance and trade, but it cannot move money off the exchange.
Why it matters
The permissions on a key decide the worst that can happen if it leaks. A key that can withdraw can empty an account. A trade-only key, limited to your app's server addresses, is far safer: even if someone copied it, they could not use it from elsewhere or take funds out.
How TradeCorgi uses it
TradeCorgi accepts trade-only keys and rejects any key with withdrawal permission, when you connect it and on every daily check after that. Keys are encrypted with a key unique to you and decrypted only inside the service that places orders. Each exchange page shows how to create the right key step by step.