Add Withdrawal Addresses - API Permission

When you enable the Add Withdrawal Addresses permission on an API key, any application or service using that key can:

• Add new cryptocurrency and fiat withdrawal addresses to your account.
• Remove existing withdrawal addresses from your account.

This means the API key holder can modify where your funds are eligible to be sent without logging in to kraken.com or using the Kraken app.

Enabling this permission significantly increases the potential impact if your API key is ever compromised. Before enabling it, carefully consider the following risks.

If an attacker obtains your API key (through a data breach, phishing, malware, or any other means), they could add their own withdrawal address to your account. Combined with the Withdraw Funds permission, this would allow an attacker to withdraw your assets to an address they control.

Many users connect API keys to third-party services such as portfolio trackers, trading bots, and tax reporting tools. If you grant the Add Withdrawal Addresses permission to a key used by a third-party service:

• The third-party service itself could be compromised. Even reputable services can suffer security breaches. If an attacker gains access to the service's infrastructure, they could use your stored API key to add a malicious withdrawal address to your account.
• The third-party may store your key insecurely. You have no control over how a third party stores, transmits, or protects your API credentials.
• Rogue employees or insiders at a third-party company could misuse API keys that have elevated permissions.

The Add Withdrawal Addresses permission becomes especially dangerous when paired with the Withdraw Funds permission on the same API key. An attacker with access to a key that has both permissions could add their own address and immediately initiate a withdrawal, all through the API with no additional verification required beyond the key itself.

If you do need to use the Add Withdrawal Addresses permission, take the following steps to reduce your risk.

Restrict your API key so it can only be used from specific IP addresses. This means that even if your key is stolen, it cannot be used from an unauthorized network.

Configure your API key to automatically expire after a set period. This limits the window of time an attacker has to use a compromised key.

Only enable the permissions your application actually requires. If an application only needs to read account data or place trades, do not grant it withdrawal or address management permissions.

Use a dedicated API key for each application or use case. This way, if one key is compromised, only a limited set of permissions is exposed.

Regularly review the withdrawal addresses on your account and check your API key usage logs. If you see addresses or activity you do not recognize, revoke the API key immediately and contact Kraken Support.

Add a second layer of protection by enabling 2FA directly on your API key. When enabled, every API call made with the key must include a valid 2FA code, meaning a stolen key alone is not enough for an attacker to make changes to your account.

Learn more: How does two-factor authentication (2FA) for API keys work?

• How to generate an API key pair

• API key permissions explained