API Keys Setup
API keys allow Crodl to communicate with your exchange accounts. This guide covers creating, managing, and securing your API keys.
What Are API Keys?
API keys are credentials that grant third-party applications (like Crodl) access to your exchange account. Depending on the exchange, they consist of:
- Key Name — A label to identify this connection in Crodl (required for all exchanges)
- API Key — A public identifier
- Secret Key — A private key for signing requests
- Passphrase — An additional secret (required by Blofin, Bitget, and OKX)
- API Mode — Live or demo trading mode
Hyperliquid is different — it uses wallet addresses and an agent private key instead of traditional API credentials.
Required Permissions
Crodl requires only two permissions:
| Permission | Required | Purpose |
|---|---|---|
| Read | Yes | View balances, positions, orders |
| Trade | Yes | Place, modify, and cancel orders |
| Withdraw | No | Never enable this for Crodl |
Never grant withdrawal permissions to any third-party application. Crodl will never request withdrawal access, and you should be suspicious of any service that does.
IP Whitelisting
Crodl executes trades from its servers. If your exchange supports IP whitelisting (recommended for security), add the following IP address:
187.127.209.38
The server IP is also displayed at the top of the API Keys settings page in Crodl with a copy button for easy access.
Credentials by Exchange
| Exchange | API Key | Secret | Passphrase | Region | Mode |
|---|---|---|---|---|---|
| Blofin | Yes | Yes | Yes | — | live / demo |
| Bitunix | Yes | Yes | — | — | live / demo |
| Bybit | Yes | Yes | — | Yes | live / demo |
| Bitget | Yes | Yes | Yes | — | live / demo |
| OKX | Yes | Yes | Yes | — | live / demo |
| Hyperliquid | — | — | — | — | live / testnet |
Hyperliquid requires: Master Address, Agent Address, and Agent Private Key.
Adding Keys to Crodl
- Go to Settings → API Keys in Crodl
- Select the exchange tab (Blofin, Bybit, Bitget, Bitunix, OKX, or Hyperliquid)
- Fill in your credentials in the form at the bottom of the tab
- Click Add API Key
- Click Verify on the newly added key to test the connection
A green "Connected" badge confirms the key is working. If verification fails, hover over the status badge to see the error details, then double-check your credentials and permissions.
Each exchange tab loads independently — your keys are only fetched when you first visit that tab.
Security Tokens
When you add an API key, Crodl generates a security token for it. This token is used to authenticate webhook triggers without exposing your actual API credentials.
Security tokens are not listed on the API Keys settings page. Instead, they're included automatically when you export a trigger's webhook payload: create a trigger in the Terminal, then use its Copy JSON action to get the TradingView-ready payload with the security_token already filled in. See Triggers for the full webhook setup.
For Claude, Codex, and other MCP clients, use MCP Access instead of pasting security tokens into trade requests. MCP keys bind to your saved exchange keys and inject the webhook token server-side for direct trade tools. If you explicitly ask an MCP client to fetch a TradingView-ready saved trigger payload, Crodl can reveal that one trigger's security_token.
MCP Access Keys
MCP access keys are separate from exchange API keys and webhook security tokens. They let external MCP clients use scoped Crodl tools without seeing your exchange credentials. Webhook security_token values are only returned when you explicitly request a single TradingView-ready saved trigger payload.
Create and manage them in Settings → MCP. You can choose read, open-trade, and close-trade scopes, bind exact exchange accounts, rotate secrets, or revoke access at any time.
See MCP Access for setup steps, supported tools, and payload examples.
Managing Keys
Viewing Keys
Your saved API keys are listed under Settings → API Keys, organized by exchange tabs. Each key displays:
- Key name and mode badge (Live or Demo)
- Connection status (Connected / Not connected)
- Verify and Delete action buttons
Sensitive fields (secrets, passphrases, private keys) are hidden after creation and cannot be retrieved.
Verifying Connection
Click Verify on any key to test the connection. Crodl makes a test API call and updates the connection status badge. If verification fails, the error message is shown in a tooltip on the status badge.
Removing Keys
- Click the Delete button next to the key
- Confirm the deletion in the dialog
- The key is permanently removed from Crodl
Deleting a key in Crodl only removes it from our platform. The key still exists on your exchange — delete it there too if you no longer need it.
Need Help?
Each exchange tab has a "Need help?" button that opens an interactive step-by-step guide with:
- Numbered steps with descriptions
- Pro tips for each exchange
- Direct links to the exchange's API management page
- Screenshot-backed exchange setup walkthroughs, including OKX
Security Best Practices
- IP whitelisting — Add Crodl's server IP (
187.127.209.38) to your exchange's allowed list - Regular rotation — Change keys periodically (every 30–90 days)
- Minimal permissions — Only grant read and trade access
- Separate keys — Use unique keys for each application
- Secure storage — Never share keys via email or messaging apps
- Demo first — Test with demo/testnet keys before using live credentials
If you suspect your API key has been compromised, immediately delete it on your exchange and create a new one.