To limit the damage from a leaked key, some actions are available only on the site, with confirmation codes:

changing the email or the password, two-factor authentication or the anti-phishing code;
identity verification;
giving a key the User: Write permission: it can be granted only on the site, so a key can never create another key that manages keys.

Through the API:

withdrawals and creating or changing API keys work only with a key of the main account that has an IP whitelist;
a new key created through the API must have an IP whitelist within the whitelist of the key that creates it;
a key can give a new or changed key only permissions it has itself: for example, a key without Wallet: Withdraw cannot create a key that withdraws (on the site you can give any permission);
keys of sub-accounts cannot manage sub-accounts or API keys and cannot withdraw; a sub-account key can only freeze its own sub-account;
the status of a sub-account cannot be changed through the API. A key of the main account with User: Write can freeze a sub-account; unfreezing is done only on the site, with a confirmation code;
a withdrawal through the API needs no confirmation code, so keep the Wallet: Withdraw permission only where it is really needed.

Withdrawals through the API follow the same rules as on the site: limits, the 24-hour block after security changes and manual review of some withdrawals.

Details for developers are in the API documentation.

Stay safe: Strade support never asks for your password, 2FA codes, seed phrase or API secret.

What can I not do through the API?