API key least-privilege and rotation
Issue API keys with the minimum privileges required. For example, give read-only keys to analytics services and create separate trade-only keys without withdrawal permissions for bots. Rotate keys periodically and track creation and rotation events in a central log.
IP whitelisting & network controls
Whitelist trusted IP ranges where feasible to bind keys to known infrastructure. For teams, use VPN or private peering to further reduce exposure and enforce network-level access controls.
Session audits & alerts
Schedule periodic audits to enumerate active sessions and authorized applications. Configure alerts for new session creation or suspicious login patterns and have a runbook that specifies immediate revocation and escalation steps.
Secrets management & principle of least privilege
- Store keys in an enterprise secret manager with controlled access.
- Use role-based access controls for team accounts instead of shared personal logins.
- Require multi-person approval for high-risk actions like creating withdrawal-enabled keys.
Reminder: This operator guide is educational, not an official Kraken document, and it contains no credential-collecting forms.
Harden my operator controls