Grant only what is needed
Review the current Bitfinex interface and API documentation, then enable only the Funding scopes the workflow actually needs. Do not enable unrelated permissions for convenience.
A Bitfinex API connection for lending is intended to read the required Funding state and perform restricted Funding management actions. Alpha Rate does not require withdrawal permission; users should create, inspect and revoke their API key on Bitfinex.
Permission principles
Withdrawal permission is not required
Funding management does not require withdrawal permission. Without it, the key cannot withdraw assets to an external address.
Keep revocation control
You can revoke the API key on Bitfinex and stop the service in Alpha Rate. After revocation, confirm the connection and any pending routine action.
Never share secrets
API keys, secrets, private keys and passwords should never be pasted into chat, URLs, issues or public documents. Alpha Rate does not request a wallet private key.
Before connecting
- Confirm you are using your own Bitfinex account and intended environment.
- Review every key permission and reject withdrawal or unrelated trading scopes.
- Keep the revocation procedure available and periodically review whether the key is still needed.
- Read the risk disclosure and lending bot overview.
Relationship: Alpha Rate is an independent third-party tool and has no official affiliation, agency or endorsement from Bitfinex.
Frequently asked questions
Does Alpha Rate need my private key?
No. A Funding API key is not a wallet private key. Never provide a wallet private key.
What happens after I revoke the API key?
Subsequent API requests fail and the related service flow should stop. Create a new restricted key only after reassessing the connection.
Should I enable withdrawal permission just in case?
No. The Funding workflow does not require it. Keep the key at the least-privilege scope.