An exchange API key should have the smallest permission set that can do its job. For Madai, that means reading account state and submitting Futures orders. Withdrawal and transfer permissions should remain off.
IP restriction adds a second boundary. Binance accepts requests for that key only from the Madai trading server address, rather than any device that obtains the credentials.
Madai stores the key through the authenticated API and encrypts it at rest. You remain responsible for reviewing exchange permissions, rotating compromised keys, and deleting access you no longer use.