Connecting simulation tools to your casino accounts programmatically offers massive convenience, enabling hands-free automated play and rapid calculations. However, your **API (Application Programming Interface) key** is a highly sensitive credential. If someone gains unauthorized access to it, they can execute actions on your behalf. Protecting your key is paramount.
1. Generating Restricted Keys
When you generate an API key in your Stake settings pane, the platform provides toggles for different levels of authorization. Always apply the principle of least privilege:
- Read/Write Permissions: Enable read-only permissions if you only want the bot to analyze board history, or select basic write permissions to place wagers.
- DISABLE Withdrawal Permissions: This is a critical security rule. Never, under any circumstances, generate an API key with withdrawal permissions active. StakeBot Premium does not require withdrawal permissions to function.
2. Preventing Phishing and Credential Sharing
Phishing is the most common way API keys are stolen. Malicious groups often create fake Telegram support accounts that mimic official developers, asking you to send them your configuration files or paste your API tokens.
Official developers will NEVER ask for your API keys. Only input your token inside the secure text prompt fields within the verified bot window on Telegram. Never share screenshots of your settings configuration or API input prompts.
3. Setting Up Periodic Rotation
Security isn't a one-time setup; it requires regular maintenance. Rotate your API keys every 30 days. Go to your settings, revoke the active token, generate a fresh key, and bind it to the bot. This limits exposure windows if a key is accidentally cached or leaked.