Plasso never stores withdrawal-enabled keys. If your broker can't restrict the scope, generate a new key with trade-only permissions before pasting it in via onboarding.