Exchange key safety: read and trade only, never withdraw

AgentiCrypto is non-custodial: your funds stay on your own exchange, and the platform never holds or moves them. The way that works is through API keys you create on your exchange and connect to the platform. Setting those keys up correctly is the single most important security step you take, so it is worth doing deliberately.

The one rule: never enable withdrawals

When you create an API key, the exchange asks which permissions to grant. AgentiCrypto only ever needs read (to see prices and your positions) and trade (to place the orders your strategy decides). It never needs withdrawal or transfer permission — so never enable it. If a key cannot withdraw, then even in a worst case it cannot be used to move your funds off the exchange.

Lock the key down further

• Restrict by IP where your exchange supports it, so the key only works from our server.
• Name the key clearly so you can find and revoke it later.
• Keep the secret safe — most exchanges show it only once.

How we store it

The keys you connect are encrypted at rest and used only to place the trades your bot decides. You can remove a key at any time in Settings, and it is deleted when you remove it or close your account. Combined with read-and-trade-only permissions, that keeps control of your funds where it belongs — with you.