Connecting a broker API safely: keys, static IP and daily sign-in

Updated 3 November 2026

A broker API key lets software place orders in your account. Treat it like a password: keep it on your own computer, give it as little power as you can, and know how to switch it off.

What an API key can do

Most brokers and exchanges give you a key and a secret from their developer or API page. With them, software can read your holdings and place orders as you. Stock brokers in India don’t let API keys withdraw money, and on crypto exchanges you choose that yourself when you create the key: leave withdrawals off.

Where Purffle Wealth keeps your keys

Your keys are stored in your operating system’s keychain (the macOS Keychain, Windows Credential Manager, or the Secret Service on Linux) on your computer only. They are never sent to Purffle’s server, and the app doesn’t show them again after you save them. Orders go from your computer straight to your broker.

Connect brokers screen with Indian brokers, global brokers and crypto exchanges, and notes on keys, trading mode and SEBI rules — The Connect brokers screen. Each venue shows what it needs, such as a static IP or a daily sign-in.

Why Indian brokers ask for more

SEBI’s framework for retail algorithmic trading (its circular of 4 February 2025) treats orders sent through an API as algo orders, and brokers have been rolling out the controls it calls for. The details differ by broker, so read your broker’s API page, but expect these:

A static IP. API orders must come from an IP address you have registered with the broker. A home connection usually changes its address, so you may need a static IP from your internet provider.
A daily sign-in. The session behind the API expires every day, and you sign in again with your broker’s two-factor login.
Limit orders. Purffle Wealth sends orders to Indian brokers as limit orders with 0.5% price protection, rather than as market orders.

How to connect a broker

Create an API app at your broker. Use the broker’s developer or API page and note the key and secret.
Register your static IP there, if the broker asks for one.
Open Connect brokers in Purffle Wealth, pick your broker and paste the key and secret.
Press Test. It checks the keys and today’s sign-in without placing anything.
Keep the trading mode on paper while you look around. Real accounts can be viewed and orders previewed before you switch.

Some connections are marked Preview only. They show exactly what would be sent but don’t send live orders until that connection has been checked against a real or sandbox account.

A safety checklist

Turn on two-factor sign-in at the broker or exchange.
On crypto exchanges, create keys with withdrawals off and, where offered, limited to your IP address.
Use one key per app, so you can revoke one without breaking the others.
If a key may have leaked, revoke it at the broker first, then remove it from the app.
Set a per-order cap and a daily cap in Settings, and know where the kill switch is.

Questions

Does Purffle see my broker keys?

No. They are stored in your computer’s keychain and never sent to Purffle’s server.

Can the app withdraw money from my account?

No. Purffle Wealth places orders only after you approve them and has no way to move or withdraw funds. On crypto exchanges, create keys with withdrawals off.

How many accounts can I connect?

Basic connects up to 2 broker or exchange accounts, Pro up to 5, and Max has no limit. Paper trading is never counted.

Please read: Purffle Wealth is software you run yourself. It is not investment advice; Purffle is not a SEBI-registered adviser. Investments are subject to market risk. This guide is general information, not advice for your situation. Read the terms before you invest.