API Key Security for Trading Bots: Scopes, IP Allowlists, and Rotation

Withdrawal permission off, IP allowlists on, one subaccount per bot, and a rotation routine that does not cause downtime. Plus the ten minute playbook for the day a key leaks anyway.