Security: least-privilege API keys
Give your API key the right permissions, know what Fastbot checks and what you must check yourself, and how to cut the connection when you need to.
The rule in one line: give an API key exactly the permissions it needs and nothing more. For Fastbot that means reading and trading on, withdrawals off.
Your money never moves
Everything stays in your own exchange account. Fastbot only places orders; it never holds your funds and cannot withdraw them when the key is set up correctly.
Permissions per exchange
| Exchange | Enable | Never enable |
|---|---|---|
| Binance | Enable Reading, Enable Spot & Margin Trading (plus Futures if you use it) | Enable Withdrawals |
| eToro | Real, Read, Write | — |
| DNSE | DNSE's standard trading permission | — |
On Binance, restrict the key to the IP address of the server running your bot if the option is offered. Message @fastbot_support for that address.
What you have to check yourself
Fastbot does not inspect whether your key has withdrawal rights. Switching that off when you create the key on the exchange is your responsibility.
If you already created a key with withdrawal rights: go to the exchange, delete that key, create a new one with least privilege, and enter the new one into Fastbot. Do not merely edit the old key's permissions if it has ever been pasted anywhere.
The DNSE Gmail app password
If you use DNSE you also enter IMAP_PASSWORD — a 16-character app password, not your Gmail password. It only allows reading mail and can be revoked at any time at myaccount.google.com/apppasswords without affecting your Google account.
Never share your keys
Nobody needs your API keys, the Fastbot support team included. We will never ask you for one.
If you have sent a key to somebody, or pasted one into a group chat by mistake: delete it on the exchange immediately and create a new one.
Inside the bot, key values are always masked when shown back to you:
Fastbot⚙️ Edit .envabcd****wxyz
Pick an action:The bot only listens to you
Fastbot ignores messages from any Telegram account it has not been given. A stranger who finds your bot can do nothing with it.
Three ways to stop Fastbot
| Method | Effect | Use when |
|---|---|---|
| ⏸ Pause Bot in ⚙️ Settings | Automatic signals stop at once; you can still trade by hand | You want a break |
| Delete a key's value in ⚙️ Edit .env | The bot loses access to that exchange after a restart | Stopping one exchange |
| Delete the API key on the exchange | Immediate and final | Cutting off completely, or you suspect a leak |
The third is the definitive one: once the key is gone at the exchange, no software can use it.
Fastbot does not manage risk for you
The bot does exactly what you set up. It will not shrink your position size, stop after losses, or change your leverage. Leverage, margin and risk limits are yours to set on the exchange — see Spot & Futures orders.