When you create a Bitfinex API key for Hahalend, grant exactly two permissions: Read and Funding. Leave Withdraw and Trading turned off. That's the entire rule — Hahalend only ever needs to see your balance and place or cancel lending offers, and it actively refuses to save a key with more access than that.
The rest of this guide covers setting that up on Bitfinex step by step, plus what happens to the key after you hand it over: how it's encrypted, when it actually gets decrypted, and what the honest worst case looks like if something ever goes wrong on Hahalend's own systems.
Step-by-Step
Open API key creation on Bitfinex
From your Bitfinex account, go to API Keys and start creating a new key specifically for Hahalend — don't reuse a key you've already granted broader access to elsewhere.
Enable exactly two scopes: Account Read and Wallets/Orders Funding
Toggle on Read and Funding. Leave every Withdraw scope and every Trading or order-execution scope off. If you're ever unsure what a specific scope does, leaving it off is the safer default — Hahalend will tell you immediately if something it actually needs is missing.
Optionally restrict the key to Hahalend's IP addresses
Bitfinex lets you lock a key to specific IP addresses. This step is optional but recommended: even if the key value itself ever leaked somehow, it couldn't be used from anywhere except Hahalend's own servers. The exact IPs to whitelist are shown in the setup guide when you connect a key.
Paste the key and secret into Hahalend
Hahalend checks the permissions the moment you submit it. If Withdraw or Trading is enabled, the connection is rejected immediately, and you'll need to fix it on Bitfinex before trying again. Once it's accepted, you'll only ever see the last 4 characters of the key again in your dashboard — the full value isn't shown back to you or stored anywhere in a readable form.
Turn on 2-step verification for your Hahalend account
This protects login to your Hahalend account itself, separate from anything the API key controls. It's optional, and you can turn it off again anytime, but it's the easiest additional step available to you.
What Happens to the Key After That
Your key and secret are encrypted with AES-256-GCM the moment they're saved — what actually sits in the database is ciphertext, not a readable key. When Hahalend's server needs to check your balance or place a lending offer, it decrypts the key in memory for that one operation and uses it right away. It's never written back to disk in plain text, and it's never included in logs.
The Honest Worst Case
If Hahalend's own servers were ever fully compromised, the stored keys would still be ciphertext, and Bitfinex would still enforce the Withdraw/Trading restriction on its own side — that protection doesn't depend on Hahalend staying secure. The honest edge case is an attacker who also obtained the separate encryption key needed to unlock stored credentials: they could see balances and history, and place or cancel lending offers, but they still could not move funds out of Bitfinex. That limit comes from what the permission was allowed to do in the first place, not from a promise on top of it.
Why the Permission Boundary Matters
It might seem like a small distinction — Read and Funding versus Withdraw and Trading — but it's the entire reason the rest of the security model works. If a key with wider access ever leaked, or a system holding it were compromised, the blast radius is defined by what that key is allowed to do, not by how well it was otherwise protected. Keeping the key scoped to only what's needed is what makes every other protection layered on top of it meaningful in the first place.
This is also why rotating a key occasionally is reasonable practice, even though nothing here requires it: if you ever suspect a key might have leaked, you can revoke it on Bitfinex and create a fresh one in a couple of minutes, and Hahalend will simply reject the old one going forward once it's disabled on Bitfinex's side.
If You Ever Suspect a Leak
If you ever think a key might have been exposed — a leaked screenshot, a compromised device, anything — the fastest fix is on Bitfinex's side, not Hahalend's: revoke the key from your Bitfinex API settings immediately. Once it's revoked there, it stops working everywhere, including inside Hahalend, within moments.
After that, create a fresh key following the same steps above and reconnect it in Hahalend. Because the old key never had Withdraw or Trading permission in the first place, the practical risk during that window was limited to someone being able to see your balance and history, or place and cancel lending offers — not move funds out.