Connecting a bot to the Kraken API starts with a key pair — and the single most important decision you will make is how little power to give it. A trading bot needs to read balances and place orders. It does not need to move your money off the exchange. Scoping the key with least privilege means that even in a worst case, a leaked key cannot drain your account.
Least privilege, in one sentence
Grant only the permissions required to trade, and refuse everything else — especially withdrawals. A key that cannot withdraw cannot be used to steal funds, only to trade them within the venue, which is exactly the boundary a disciplined setup wants.
Steps
- Open the Kraken API settings. Sign in to Kraken and open the API management screen to generate a new key pair dedicated to this bot.
- Grant query and trade only. Enable querying balances and orders, and placing and cancelling orders — the minimum a disciplined bot needs to operate.
- Leave withdrawals disabled. Never grant withdrawal permission to a trading key. A trading bot has no legitimate reason to move funds off the exchange.
- Store the secret securely. Copy the private key once into encrypted storage. Treat it like a password: never paste it into logs, screenshots, or chat messages.
- Start in paper mode. Connect the key in paper mode first and confirm read access works before you ever clear the paper-to-live gate.
Treat the secret like a password
The private key is shown once. If it leaks, revoke it immediately and issue a new one — there is no penalty for rotating keys often. Use a separate key per bot or integration so you can revoke one without disrupting the others, and review your active keys periodically to retire any you no longer use.
Once your key is connected, learn what changes when you go live in paper mode vs live mode on a Kraken bot. For the limits the bot enforces around every order, see Risk Management & Bot Safety, and for the signals it acts on, the signals pillar.