IP whitelisting
IP whitelisting limits an exchange API key to a list of server addresses, so a copied key cannot be used anywhere else. Definition and how to set it up.
Definition
A setting on an exchange API key that only accepts requests from a list of IP addresses, so the key is useless to anyone outside those servers.
IP whitelisting, also called an IP allowlist or trusted IPs, ties an API key to specific server addresses. Requests from any other address are refused, even if they carry the right key and secret.
Example
When you connect Binance to TradeCorgi, the app shows the server addresses its agents use. On Binance you choose "Restrict access to trusted IPs only" and add those addresses. If the key ever leaked, a request from anyone else's computer would be rejected.
Why it matters
A leaked key is one of the main risks of connecting any trading app. Whitelisting removes most of that risk, because the key only works from the servers you named. Some exchanges also require it before they allow trading permissions on a key.
How TradeCorgi uses it
TradeCorgi runs agents from fixed server addresses so you can whitelist them on every exchange that supports it, and each exchange page shows where the setting is. Combined with trade-only permissions, it means a key cannot withdraw and cannot be used from anywhere else.
A common mistake
Adding only some of the addresses an app uses. Requests from the missing address are refused, and the connection fails in confusing ways. Add every address the app lists, exactly as shown, and nothing else.