> ## Documentation Index > Fetch the complete documentation index at: https://docs.blockhouse.app/llms.txt > Use this file to discover all available pages before exploring further. # API keys and IP addresses > The sub-account, keys and IP lists each exchange needs, at a glance. ## Sub-accounts Your prime broker opens a sub-account on each exchange that only Blockhouse trades in. Your capital for the strategy sits there, and its keys can only reach it. * Don't trade in it yourself, or share it with another strategy or Blockhouse account. * Set its account mode and keys on the sub-account, not your main account. * Check it's linked to your prime broker, and note the account ID the broker gives it (FalconX doesn't use one). ## API keys Each exchange needs a read-only key and a trading key on the sub-account; Kraken needs both for Spot and for Futures. Your guide in [Step 4: Credentials](https://docs.blockhouse.app/open-an-account/connect-your-exchanges) says whether you or your prime broker creates them. | Key | Used for | Permissions | Restrict to | | - | - | - | - | | Read-only key | Balances, positions, orders and history | Read only | Read-only API IPs | | Trading key | Placing and cancelling orders | Read and trade, for the products the strategy trades | Trading API IPs | > [!CAUTION] > > Never enable withdrawals or transfers on these keys: funds move between exchanges through your prime broker. The one exception is Kraken's Futures trading key, which needs **Withdrawal API** set to **Full access** to move margin between the account's own Futures and Spot wallets. On a Futures key, that permission can't send funds anywhere else. * Copy each secret as soon as it's shown. Most exchanges show it only once. * Keep both keys somewhere safe, such as a password manager, until you submit the Credentials step. * Use them for Blockhouse only, not with another app or bot. ### What the Credentials step asks for | Exchange | Read-only key | Trading key | | - | - | - | | Binance, Bybit | API key, secret | API key, secret | | OKX, Bitget | API key, secret, passphrase | API key, secret, passphrase | | Kraken | Spot and Futures: API key and private key each | Spot and Futures: API key and private key each | The passphrase is set when the key is created, by you or your prime broker. It isn't your account password. | Prime broker | Broker fields | Account ID per exchange | | - | - | - | | BIT | API key, secret | BIT account number, for example `1234567_binance_000001` | | LTP | API key, secret | LTP account ID | | Bequant | API key, secret | Bequant account ID | | FalconX | API key, secret, passphrase, email | None | ## IP addresses Blockhouse trades from dedicated IP addresses, and each key is restricted to one list of them. They're allocated when your SMA is signed, so they first appear at the Credentials step. | List | Goes on | Tick | | - | - | - | | Read-only API IPs | The read-only key on each exchange | IPs are whitelisted for read-only API | | Trading API IPs | The trading key on each exchange | IPs are whitelisted for trading API | | Transfer API IPs | The transfer key at your prime broker | IPs are whitelisted for transfer API | Each list's **Copy** menu offers **Newline**, **Space** or **Comma**: pick the one your exchange's IP field accepts.