Permission	Allows
User: Read	read the profile, sub-accounts and API keys
User: Write	change sub-accounts and manage API keys through the API (only with the permissions the key itself has)
Wallet: Read	read balances, deposits, withdrawals and transfers
Wallet: Deposit	get deposit addresses
Wallet: Withdraw	create withdrawals
Wallet: Transfer	transfer between your accounts and sub-accounts
Trade: Read	read orders and trades
Trade: Write	place and cancel orders

Market data (prices, order book, trades, candles) is public and needs no key.

A key of a sub-account can have only what a sub-account may do: User: Read, Wallet: Read, Wallet: Deposit (the sub-account's own deposit addresses), Wallet: Transfer, Trade: Read, Trade: Write and Market: Read. It never gets User: Write or Wallet: Withdraw.

IP whitelist

With an IP whitelist, the key works only from the listed addresses: a stolen key is useless elsewhere. Some actions through the API work only with a key that has an IP whitelist: withdrawals and creating or changing API keys.

Recommendations

A trading bot usually needs only Trade: Read, Trade: Write and Wallet: Read.
Give Wallet: Withdraw only if the program really has to withdraw, and always with an IP whitelist.
Use a separate key for each program, so you can revoke one without stopping the others.

What the API cannot do at all: What can I not do through the API?

Stay safe: Strade support never asks for your password, 2FA codes, seed phrase or API secret.

API key permissions and IP whitelist