Is It Better to Use Subaccount API Keys or Webhooks for Executing Trades on Centralized Exchanges?

Trading via API offers speed and automation, but managing permissions properly is critical for account security. Do you restrict subaccount API keys strictly to trade execution while disabling withdrawal access? What redundancy measures do you set up in case your webhook provider or server experiences latency?