How to Revoke Trading Bot API Access and Secure Your Accounts

Trading bots connect to your account through API keys, investor or trading passwords, or third-party platform permissions. If you suspect a bot is unsafe, stop using it, or simply want to clean up, revoking that access takes a few minutes. Do it first; investigate afterwards.

Step 1: Revoke API keys on crypto exchanges and brokers

Most exchanges and many brokers manage API keys in an account security or API management section.

1. Log in through the official website or app, not through a link in a message.
2. Open API management (often under profile, account, security or settings).
3. Find every key you created for a bot. If you are unsure which ones, delete all keys you do not actively need.
4. Delete or disable each key. Deleting is safer than editing.
5. Check the exchange's security log for unfamiliar logins or API activity.

Menu names differ between platforms; the exchange's help centre will have a page on deleting API keys.

Step 2: Change MetaTrader and broker passwords

MetaTrader accounts usually have two passwords:

• The master (trading) password allows trading. If you gave this to a bot provider, a VPS company or a signal service, change it now in your broker's client portal or in the terminal.
• The investor password is read-only. It is safer to share, but change it too if you no longer want the provider to see your account.

Also change the password for your broker's client portal, which controls deposits and withdrawals.

Step 3: Remove third-party connections

• Disconnect copy trading subscriptions and signal services in your broker or platform settings.
• In TradingView, remove broker connections and webhook alerts you no longer use.
• Stop or delete any VPS where the bot was running, and change the VPS password.
• Revoke app connections in your email and cloud accounts if you granted access to a bot service.

Step 4: Secure the accounts behind the accounts

• Change your email password first; it is the key to resetting everything else.
• Turn on app-based two-factor authentication (not SMS where possible) for email, broker and exchanges.
• Check withdrawal addresses on exchanges and remove any you did not add. Turn on address allow-lists if available.
• Review recent transactions and withdrawals.

Step 5: If you see unauthorised activity

Contact your broker or exchange support immediately and ask them to freeze withdrawals. Save screenshots and logs, then report the incident. See how to report a forex signal scam.

Safe API settings for next time

If you use a bot again, give it the least access possible:

• Trading only. Never enable withdrawal or transfer permission for a bot.
• IP restriction. Limit the key to the server's IP address.
• One key per bot, clearly named, so you can revoke one without breaking others.
• Sub-accounts with limited funds for testing new bots.
• Regular review. Delete keys you have not used in a month.

Why this matters

Scam bots and fake support agents sometimes ask for full API permissions or your trading password "to set up the bot". With withdrawal permission or your portal login, they can empty your account. Legitimate bots never need withdrawal rights. See automated forex trading scams.

Bottom line

Revoke first, then investigate. Give every bot the minimum access it needs, never withdrawal permission, and keep your email and two-factor authentication locked down. For more on protecting yourself, read Signal or Scam?, and for building safe automation, The Hybrid Trader.