Security
Which API Permissions Are Needed
What the platform already checks and why the final permission list is not published yet.
English localization is preserved as a draft. It uses the same claim IDs and status model as the Russian source, but remains noindex until editorial review.
An API key is validated separately and does not start anything by itself. Dashboard shows the validation result and does not reveal the secret back to the user or operator.
The final public permission list is still under Security review. Until that review is complete, use only permissions required for the agreed function and avoid additional rights.
What Is Already Checked
- Whether Bybit answers the validation request.
- Which permission groups the exchange reports.
- Whether the key is read-only.
- Whether a clear result can be stored without exposing the secret.
What Users Should Know
- UID and API are separate stages.
- Successful validation does not launch a trading contour.
- Do not send keys through Support chat or ordinary messages.
Why This Page Is Still Under Review
Until Security review is complete, documentation does not present an interim permission list as final guidance.