# Binance > Binance: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads a Binance account’s spot and cross-margin balances, trades, deposits and withdrawals, so reconciliation and reporting agents can check them against the books. It is read-only, and it is built to refuse a key that can withdraw, transfer or trade. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse. ## At a glance | Collector | Binance, version `1.0.0` | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Reads | Binance: Binance Spot and Wallet REST API ([the vendor's documentation](https://developers.binance.com/docs/binance-spot-api-docs)) | | Family | Finance | | Kind | Exchange | | Ways to connect | Access token, Key pair | | Scopes | - Read: `Enable Reading` | | Read only | Yes | | Vendor's API can move money | Yes | | Personal data | Financial | | Hosts it may contact | `api.binance.com`, `testnet.binance.vision`, `{host}` | | Vendor API versions | Spot API v3 (/api/v3), SAPI (/sapi/v1) | | Lowest engine version | `0.46.0` | ## What it reads - **Spot balances** (free and locked) and **cross-margin balances** (free, locked, borrowed, interest, net asset), one record per asset, rewritten only when it changes. Zero balances are not recorded. - **Trades** for the symbols you name in `symbols` (Binance answers trades per symbol only), from the last trade id. - **Deposits and withdrawals**, in 89-day windows (Binance allows under 90 days a request), with amount, fee, network, status, address and transaction id. - The first read goes back `history_days` (default 90, at most 3,650). **Futures are not read.** A USD-M futures account is readable only by a key with futures enabled, which can trade, so a key this collector accepts cannot read it. ## How to connect 1. In Binance, make an API key with **Enable Reading** only (an Ed25519 key is recommended), restricted to your deployment’s egress addresses. 2. In LightHouse, open **Setup and admin, Connectors**, choose **Binance**, and name the symbols and the environment (`production` or `testnet`). 3. Paste the API key and either the secret (an HMAC key) or the Ed25519 private key. Your browser seals it to your deployment; LightHouse never sees it. The credential is JSON in the variable the source names (`AAL_BINANCE` by default): `api_key`, and `api_secret` or `private_key` (a PEM), `environment`, and `view_only_confirmed` for the testnet. ## Permissions This collector is **read-only**: it sends `GET` requests only, and its read-only test proves it on every change. - **Refused by the code:** Binance states a key’s restrictions (`GET /sapi/v1/account/apiRestrictions`). Before every read, and in the health check, a key with any of these nine switches on is refused, naming what it can do: `enableWithdrawals` (withdraw), `enableInternalTransfer` (transfer internally), `permitsUniversalTransfer` (universal transfer), `enableSpotAndMarginTrading` (trade spot and margin), `enableMargin` (use margin), `enableFutures` (trade futures), `enableVanillaOptions` (trade options), `enablePortfolioMarginTrading` (trade portfolio margin), `enableFixApiTrade` (trade over FIX). The error is `Binance: refused: the credential can \; make a view-only one`. - **Not refused by the code:** a switch Binance adds later that is not on that list. `enableReading` is expected and is not checked. - **Testnet:** Binance’s spot testnet has no `/sapi`, so a testnet key’s restrictions are not stated. The collector reads only once you have confirmed the key can only read (`view_only_confirmed`), skips the margin, deposit and withdrawal calls, and says so. - **IP restriction:** the check reports `ipRestrict`; a key without one is told to pin it (it is not refused). - **Signing:** each request carries `timestamp`, `recvWindow` and a signature over the query string: HMAC-SHA256 with the secret, or Ed25519 with the private key (an RSA key is refused: `private_key is an Ed25519 key`). The secret never leaves your store. - **Hosts:** only `api.binance.com` (production) or `testnet.binance.vision`, over https; redirects are never followed. ## Limits - Spot API v3 and the SAPI wallet endpoints. - Requests are paced (0.2 s apart) and retried on 429 and 5xx with back-off. - A margin account that is absent or unreadable is skipped, not an error. - `symbols` must be alphanumeric Binance symbols such as `BTCUSDT`. - Amounts are exact decimals; a number that arrives as a float is refused. ## Data handling - Records hold financial data: balances, trades, deposit and withdrawal amounts and addresses. Documents carry the `label` you give the source (default `confidential`). - Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential. - Errors carry a status and fixed text, never a provider’s body. - The data is audit-ready for your own agents; nothing here certifies anyone against any regulation. ## Troubleshooting | What you see | What it means | What to do | | --------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------ | | `Binance: refused: the credential can withdraw; make a view-only one` | A switch that moves funds is on (the action is named) | Make a key with Enable Reading only | | `Binance does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read` | Testnet key, not yet confirmed | Confirm it can only read | | `private_key is an Ed25519 key` | The PEM is not an Ed25519 key | Use an Ed25519 key, or an HMAC secret | | `environment is production or testnet` | The environment is something else | Correct it | | `symbols are Binance symbols, e.g. BTCUSDT` | A symbol has punctuation | Use `BTCUSDT`, not `BTC-USDT` | | `Binance answered HTTP 401` | The key or signature was refused | Check the key, the secret and the IP restriction | | `Binance answered HTTP 429` | Rate limit | Nothing; the collector backs off and continues | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | -------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | Spot API v3; SAPI v1 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/binance/