How to revoke exchange API access everywhere, in five minutes
Deleting a key on the exchange is the only revoke that counts. Where the key pages live on ten exchanges, and what to do first when a tool is breached.
To revoke an app’s access to your exchange account, delete its API key on the exchange: open the exchange’s API management page, find the key and delete it. That is the only revoke that counts. Removing the account inside the app, logging out or uninstalling it leaves the key alive on the exchange, where it keeps working for anyone who holds a copy. With the key pages listed below, each exchange takes about a minute.
When should you revoke a key?
- The tool that holds it reports a breach, changes hands or shuts down. Its database is where your key lives now.
- You stopped using the tool. A key with no job is risk with no upside.
- The secret went somewhere it should not have: a chat, a screenshot, a support ticket, a shared document.
- The key page shows a key you cannot name, or permissions you do not remember granting.
- You are rotating keys anyway. Deleting the old key is the second half of every rotation.
Why doesn’t deleting it in the app revoke it?
An API key is a credential the exchange issued, and the exchange checks it on every request. The app only holds a copy. Deleting the connection inside the app removes that copy, if the app does it properly, but tells the exchange nothing, and any other copy, in a backup, a log or someone else’s hands, still works. Only the exchange can switch a key off. TrueHold is an example of the gap: deleting an exchange account there erases the stored key and its synced data, and TrueHold does not contact the exchange, so the key stays valid until you delete it on the exchange as well.
Where are the keys on each exchange?
These are the key pages of the ten exchanges TrueHold reads, as each exchange’s own help centre and API documentation described them on 25 October 2026. Menu labels move with redesigns; when a menu does not match, the account settings search usually finds “API”.
Binance
Where the keys are
Profile icon, then Account, then API Management
Worth knowing
Disable Account, under Account and Security, suspends trading and withdrawals and removes all API keys
Bybit
Where the keys are
API Management in the account menu, on the website only
Worth knowing
The emergency switch is Deactivate an Account, under Profile and Account
OKX
Where the keys are
Profile, then API; each key can be edited or deleted
Worth knowing
Freeze account and the list of authorized third-party apps are both under Profile and Security
Coinbase
Where the keys are
Keys for the Coinbase app and Advanced live in the Coinbase Developer Platform portal
Worth knowing
Apps connected by sign-in are listed at accounts.coinbase.com/security/connections
Kraken
Where the keys are
Profile icon, then Settings, then API
Worth knowing
The Global Settings Lock stops changes to API keys and other settings until it is lifted
Bitget
Where the keys are
Personal Center, then API Management
Worth knowing
Disable account, under Profile and Security, logs out every device and cancels unfilled orders
Gate
Where the keys are
Profile icon, then API Management
Worth knowing
A key not bound to an IP address is disabled after 90 days until one is bound
MEXC
Where the keys are
mexc.com/user/openapi
Worth knowing
Freeze Account makes every API key invalid; unfreezing goes through customer service
BingX
Where the keys are
User Center, then API Management
Worth knowing
Lock Account, in the account settings, stops logins, trading and withdrawals
Backpack
Where the keys are
Settings, then API Keys, on the website
Worth knowing
For suspected account access, its help centre points to a new password, 2FA and an email to support
| Exchange | Where the keys are | Worth knowing |
|---|---|---|
| Binance | Profile icon, then Account, then API Management | Disable Account, under Account and Security, suspends trading and withdrawals and removes all API keys |
| Bybit | API Management in the account menu, on the website only | The emergency switch is Deactivate an Account, under Profile and Account |
| OKX | Profile, then API; each key can be edited or deleted | Freeze account and the list of authorized third-party apps are both under Profile and Security |
| Coinbase | Keys for the Coinbase app and Advanced live in the Coinbase Developer Platform portal | Apps connected by sign-in are listed at accounts.coinbase.com/security/connections |
| Kraken | Profile icon, then Settings, then API | The Global Settings Lock stops changes to API keys and other settings until it is lifted |
| Bitget | Personal Center, then API Management | Disable account, under Profile and Security, logs out every device and cancels unfilled orders |
| Gate | Profile icon, then API Management | A key not bound to an IP address is disabled after 90 days until one is bound |
| MEXC | mexc.com/user/openapi | Freeze Account makes every API key invalid; unfreezing goes through customer service |
| BingX | User Center, then API Management | Lock Account, in the account settings, stops logins, trading and withdrawals |
| Backpack | Settings, then API Keys, on the website | For suspected account access, its help centre points to a new password, 2FA and an email to support |
What should you do first when a tool is breached?
- Delete the key on every exchange where that tool had one, before anything else, starting with the exchange that holds the most money.
- Check what each key could do. If it was read-only, the exposure was information: balances and history. If it could trade or withdraw, look through open orders, positions, recent trades, withdrawals and the withdrawal address list for anything you did not do.
- If anything looks wrong, change the account password, check the two-factor settings and use the exchange’s emergency switch from the table where it has one.
- Close the tool’s other doors too: apps connected through a sign-in button rather than a key, and any token approvals your wallets gave to its contracts.
- Only then create fresh keys, read-only, one per tool you still use, each named after its tool.
Won’t old keys expire on their own?
Some will. Bybit, Gate and MEXC stop keys that are not bound to an IP address after 90 days. The clean-up has gaps, though. OKX and BingX never expire a read-only key, and on most exchanges a key bound to an IP address lasts until someone deletes it. The 20-exchange table lists each rule. Expiry is a safety net for keys you forgot, not a way to revoke the one you are worried about today.
How do you revoke TrueHold’s access?
Delete the TrueHold key on the exchange’s API page, and TrueHold loses access as soon as the exchange stops accepting it. TrueHold then shows the account as failing to sync and emails you about it; that is expected. Remove the exchange account in TrueHold to erase the stored key and the synced data, or delete the TrueHold account to remove every stored key at once. A regular audit of your API keys keeps the key page short enough that all of this stays a one-minute job.
Frequently asked questions
Is deleting the connection in my portfolio app enough?
No. The app only holds a copy of the key. Delete the key on the exchange’s API management page; that is what stops it working.
Should I revoke a read-only key after a breach?
Yes. A read-only key cannot trade or withdraw, but it still shows balances and history to whoever holds it. Deleting it takes a minute, and a new key for a tool you still trust takes five.
What if I need to cut off every key at once?
Use the exchange’s emergency switch. Binance’s Disable Account removes all API keys while suspending trading and withdrawals, and MEXC says freezing the account makes every API key invalid. Where an exchange documents no such effect, delete the keys one by one.
Does deleting an API key cancel my open orders?
Not necessarily. Bitget, for one, says that deleting a key does not automatically close positions or cancel open orders. After revoking a key that could trade, check open orders and positions yourself and cancel anything you did not place.
How do I know which app holds which key?
From the key’s name, if you named it after the tool when you created it. A key you cannot identify is safest deleted: a tool that still needs access will fail its next sync and tell you.
Terms in this article
See your whole portfolio in one view
TrueHold is an AI-native financial and DeFi platform for modern capital. Paste a wallet or link an exchange to see every chain in one view, free.
Open TrueHold →Keep reading
Sep 21, 2026 · 4 min read
Custodial vs non-custodial trackers: what the app can actually do
A tracker does not hold your coins, but what it can do with what you give it varies enormously. The four access levels, and what each one risks.
Sep 8, 2026 · 5 min read
Read-only API keys on OKX, Kraken and Coinbase, step by step
Where the read-only permission lives on OKX, Kraken and Coinbase, what to leave unticked, IP allowlists, key expiry, and what to paste into a tracker.