Crypto trading bot security checklist: 15 checks before you go live

Key takeaways

1. 1Withdrawals off on every key is the single most important setting.
2. 2Keep webhook secrets out of scripts and screenshots; know how to rotate them.
3. 3Stops must be real exchange orders, and you need a written pause rule.

Why a checklist

Most bot losses that are not strategy losses come from a short list of preventable mistakes: a key with withdrawal permission, a webhook secret pasted into a public script, leverage set for a backtest instead of a real account, or a position left unprotected when something broke. Go through this list before any live key goes near automation.

Keys

1. 1Every key is trade-only: read and trade on, transfer and withdraw off.
2. 2One key per tool, named after it, so you can revoke one without breaking others.
3. 3DEX venues use agent keys, never a seed phrase.
4. 4IP allow-lists only when you know the bot’s outbound IP.
5. 5Old and unused keys are deleted on the exchange, not just in the bot.

Webhooks and secrets

1. 1Every alert message includes the webhook secret, and nothing else accepts orders.
2. 2The secret never appears in public scripts, screenshots or shared layouts.
3. 3You know where to rotate the secret, and how to rebuild alerts afterwards.
4. 4The bot validates messages against an allow-list and rejects unknown fields.

Risk

1. 1Leverage is clamped to the lower of your policy and the venue maximum.
2. 2Stops and targets are real exchange orders, placed right after each fill.
3. 3A daily loss cap or drawdown rule stops new entries on bad days.
4. 4Position sizes assume correlated tokens can all move against you at once.

Operations

1. 1Weeks of paper or testnet results you understand, including the losing trades.
2. 2You know how to pause everything in one step and how to close positions directly on the exchange.

What a trustworthy service must never do

These are TensorTrader's own non-negotiables, and a fair test for any tool you consider.

ask for withdrawal permission

Never needed for trading

store your seed phrase

Agent keys exist for this reason

log secrets

Keys, tokens and webhook secrets stay out of logs

trade live by default

A stored key is not permission to trade live

guess on errors

Ambiguous confirmations must stop the order, not retry blindly

The five checks people skip most

Each one is cheap to fix and expensive to learn the hard way. Put a recurring reminder in your calendar to review keys and secrets every month.

old keys

Keys from tools you stopped using, still active on the exchange

public secrets

Webhook secrets inside published Pine scripts or chart screenshots

backtest leverage

Leverage chosen from a backtest rather than from a real account’s risk budget

correlation

Ten altcoin positions that are really one bet on the market

exit plan

No written rule for when to pause, and no practice closing positions by hand

Rotating secrets without downtime

1. 1Rotate the credential in the provider tab of Settings.
2. 2Re-run the same Batch Create plan; alerts are recreated with the new secret.
3. 3Delete the old alerts from the Alerts tab once the new ones show as active.

Frequently asked questions

What is the single most important setting?

Withdrawals off on every key. It turns a leak from theft into bad trading.

Should I use a separate exchange account for bots?

A subaccount or separate account with only the capital you intend to automate limits the blast radius.

Is two-factor authentication enough?

It protects your login, not your API keys. Keys still need trade-only permissions and safe storage.

Should I use a dedicated email for exchange accounts?

It reduces phishing exposure and makes suspicious messages easier to spot.

How often should I review keys?

Monthly, and immediately after you stop using any tool.

Keep reading

• Crypto trading automation, paper first: the complete guide

  How to automate crypto trading without losing your shirt: key safety, testnets, market regimes, DCA, leverage, fees, backtests versus forward tests, choosing a platform, and our own honest results.

• Trade-only API keys: which permissions to enable, and which never to enable

  A plain guide to exchange API key permissions for trading bots: what trade, read, transfer and withdraw mean, the passphrase exchanges, IP allow-lists and DEX agent keys.

• Is a Hyperliquid trading bot safe? 10 questions answered

  Custody, keys, leverage, liquidation, outages and the operator: the real risks of automating Hyperliquid and how to reduce each one.

• Non-custodial trading automation: your keys, your exchange, no deposits

  Why TensorTrader never holds your funds: execution on your own exchange accounts with trade-only keys and DEX agent wallets, and how that differs from pooled bot services.