Claude Code + Binance API: Complete Setup Guide

What You’ll Set Up

By the end of this guide, you’ll have:

• A Binance account with API keys configured for trading
• Claude Code installed and ready to use
• A Python environment with the CCXT library
• A working script that fetches your account balance

Prerequisites

• A computer with Python 3.10+ installed
• A Binance account (we’ll show you how to get API keys)

Step 1: Get Your Binance API Keys

1. Log into your Binance account
2. Navigate to Account → API Management (see the Binance API documentation for full details)
3. Click “Create API” and choose “System Generated”
4. Name it something like trading-bot-dev

Important: Only enable “Enable Spot & Margin Trading”. Do NOT enable withdrawals.

Save your API key and secret somewhere safe — you won’t be able to see the secret again.

Step 2: Install Claude Code

Open your terminal and install Claude Code:

npm install -g @anthropic-ai/claude-code

Verify the installation:

claude --version

Step 3: Set Up Your Python Project

Create a new project directory and set up a virtual environment:

mkdir my-trading-bot && cd my-trading-bot
python3 -m venv venv
source venv/bin/activate
pip install ccxt python-dotenv

Create a .env file for your API keys:

BINANCE_API_KEY=your_api_key_here
BINANCE_API_SECRET=your_secret_here

Step 4: Your First API Call

Ask Claude Code to generate a simple script:

claude "Write a Python script that uses ccxt to connect to Binance
and fetch my USDT balance. Use python-dotenv to load API keys
from a .env file."

Claude Code will generate something like:

import ccxt
import os
from dotenv import load_dotenv

load_dotenv()

exchange = ccxt.binance({
    'apiKey': os.getenv('BINANCE_API_KEY'),
    'secret': os.getenv('BINANCE_API_SECRET'),
})

balance = exchange.fetch_balance()
usdt = balance['total'].get('USDT', 0)
print(f"USDT Balance: {usdt}")

Run it:

python balance.py

If you see your USDT balance printed, everything is working.

Protecting Your API Keys

Before You Commit Any Code

Add .env to your .gitignore before your first commit. This is the single most important step:

echo ".env" >> .gitignore

Verify it is ignored:

git check-ignore -v .env

If this command prints nothing, the file is not ignored — add the .gitignore entry and check again. If you see .gitignore:.env, you are safe to commit.

Never hardcode keys directly in Python files. Always load them via os.getenv() or python-dotenv as shown in Step 4.

If Your BINANCE_API_SECRET Is Accidentally Exposed

If you committed a .env file, pushed credentials to GitHub, or shared code that contained your Binance API key, treat the key as compromised and act immediately:

1. Revoke the key now. Log into Binance → Account → API Management. Find the key and delete it. Deleting it makes it invalid within seconds — any requests using that key will start failing immediately.

2. Check for unauthorized activity. In Binance, go to Account → Order History and Trade History. Filter by the past 24 hours. Look for any orders you did not place. If you see unauthorized trades, contact Binance support. Unauthorized withdrawals require urgent escalation through their security team.

3. Generate a new key. Create a fresh API key in Binance API Management. Name it clearly (for example, trading-bot-prod-2). Copy the new key and secret into a new .env file.

4. Clean git history if the repo is public or shared. Deleting the .env file in a new commit is not enough — the secret remains in every earlier commit and is accessible to anyone who clones or browses the repository. Automated tools continuously scan GitHub for newly pushed secrets and can find them within minutes of a push.

For a private repo with no other collaborators: the revoked key (step 1) is now worthless regardless of what remains in history. Generate a new key and move on.

For a public repo or a shared private repo, scrub the secret from every commit using git filter-repo:

# Install: pip install git-filter-repo
# Replace EXPOSED_SECRET_VALUE with the exact string that was committed
printf 'EXPOSED_SECRET_VALUE==>REMOVED_SECRET' > /tmp/secret-replacements.txt
git filter-repo --replace-text /tmp/secret-replacements.txt
git push origin --force --all
git push origin --force --tags

After the force-push, anyone who cloned the repo before must re-clone. GitHub may cache old commit data briefly — if you need faster removal from their CDN, contact GitHub support after pushing.

5. Review your .gitignore. Check that .env, .env.local, and any other credential files are excluded. A common mistake is having .env listed but not .env.production or .env.local.

Additional Best Practices

• Enable IP access restrictions on your Binance API key — under API Management, restrict the key to your server’s IP address. This limits damage even if the key leaks.
• Never enable Enable Withdrawals on a trading bot key. If a bot key is compromised, an attacker can only trade, not withdraw funds.
• Rotate keys periodically, especially after team members leave or when you deprecate old bots.

Next Steps

• Build a DCA bot — Now that your setup is complete, follow the AI DCA Bot in Python tutorial to build your first trading bot
• Build a grid bot — Ready for something more active? Try building a grid trading bot with Claude Code