Security & Trust
Your API keys are sensitive. Here’s exactly how we protect them—and why you can trust us with them.
The Most Important Thing
Section titled “The Most Important Thing”TokenBot cannot withdraw your funds. Ever.
When you create API keys for TokenBot, you only enable “trade” permissions. Withdrawal permissions stay OFF. Even if someone stole your API key from us (which our security prevents), they couldn’t move your money.
Your funds stay on your exchange, under your control.
How We Protect Your API Keys
Section titled “How We Protect Your API Keys”Encryption at Rest
Section titled “Encryption at Rest”Your API keys are encrypted using 256-bit AES encryption before being stored. This is the same standard used by banks and governments.
Even if someone accessed our database, they’d see encrypted gibberish—not your actual keys.
Encryption in Transit
Section titled “Encryption in Transit”All communication between your browser and TokenBot uses TLS 1.3 encryption. Data traveling over the internet is protected from interception.
Secure Infrastructure
Section titled “Secure Infrastructure”TokenBot runs on AWS (Amazon Web Services) with:
- Encrypted storage volumes
- Private network isolation
- Regular security patches
- Multi-region redundancy
No Human Access
Section titled “No Human Access”Our staff cannot see your raw API keys. The encryption happens automatically, and we don’t have the ability to decrypt them for viewing.
What API Keys Can and Cannot Do
Section titled “What API Keys Can and Cannot Do”When you create API keys, you choose their permissions. Here’s what TokenBot needs:
Required Permissions
Section titled “Required Permissions”| Permission | Why We Need It |
|---|---|
| Read | See your open orders and positions |
| Trade | Place buy and sell orders |
NOT Required (Keep These OFF)
Section titled “NOT Required (Keep These OFF)”| Permission | Why OFF |
|---|---|
| Withdraw | TokenBot never needs to move your funds |
| Transfer | No need to move between accounts |
| Futures (sometimes) | Only if you trade futures |
Best Practices for API Keys
Section titled “Best Practices for API Keys”Follow these guidelines to maximize security:
1. Never Enable Withdrawal
Section titled “1. Never Enable Withdrawal”Even though TokenBot doesn’t need it, some people enable all permissions by default. Don’t. Always keep withdrawal OFF.
2. Use IP Whitelisting (When Available)
Section titled “2. Use IP Whitelisting (When Available)”Many exchanges let you restrict API keys to specific IP addresses. If you know TokenBot’s IP range (we can provide it), whitelist only those IPs.
3. Create Dedicated Keys
Section titled “3. Create Dedicated Keys”Don’t reuse API keys across services. Create a separate key specifically for TokenBot. If you ever want to revoke access, you can delete just that key.
4. Rotate Keys Periodically
Section titled “4. Rotate Keys Periodically”Every few months, create new keys and update them in TokenBot. Delete the old keys on your exchange. This limits exposure if old keys were compromised.
5. Use Strong Exchange Security
Section titled “5. Use Strong Exchange Security”- Enable 2FA on your exchange account
- Use a unique, strong password
- Check login history regularly
What Happens If We Get Hacked?
Section titled “What Happens If We Get Hacked?”Let’s address the worst-case scenario directly.
If TokenBot were breached:
- Attackers would find encrypted API keys (useless without decryption keys)
- Even if decrypted, keys cannot withdraw funds
- We’d detect the breach and notify all users immediately
- You could revoke your API keys on each exchange in minutes
Bottom line: Even a breach couldn’t result in stolen funds.
You’re Always in Control
Section titled “You’re Always in Control”Revoking Access
Section titled “Revoking Access”Want to stop using TokenBot? Here’s how to fully disconnect:
- Log into each exchange
- Go to API management
- Delete the keys you gave to TokenBot
That’s it. The keys stop working immediately. TokenBot can no longer interact with your account.
Deleting Your Account
Section titled “Deleting Your Account”When you delete your TokenBot account:
- All your API keys are permanently deleted from our systems
- Your trading history is removed
- Your personal information is erased
We don’t keep your data after you leave.
Our Security Practices
Section titled “Our Security Practices”Regular Audits
Section titled “Regular Audits”We conduct security audits to identify and fix vulnerabilities before they can be exploited.
Penetration Testing
Section titled “Penetration Testing”External security researchers test our systems, trying to find weaknesses. We fix anything they find.
Bug Bounty Program
Section titled “Bug Bounty Program”Security researchers who discover vulnerabilities can report them responsibly and receive recognition.
Incident Response
Section titled “Incident Response”We have documented procedures for responding to security incidents, including immediate user notification.
Comparing Security Models
Section titled “Comparing Security Models”| Model | Fund Safety | Example |
|---|---|---|
| Custody (they hold funds) | ⚠️ Platform can lose/steal | FTX, Mt. Gox |
| Smart contract | ⚠️ Contract bugs = lost funds | Various DeFi hacks |
| API key (no withdraw) | ✅ Funds stay on exchange | TokenBot |
TokenBot’s model is the safest because we never have access to move your money.
Frequently Asked Questions
Section titled “Frequently Asked Questions”Can TokenBot staff see my trades?
Section titled “Can TokenBot staff see my trades?”Our systems can see trade data (to copy them), but individual staff members don’t have dashboards showing your activity. Data access is logged and restricted.
What if an exchange gets hacked?
Section titled “What if an exchange gets hacked?”That’s on the exchange, not TokenBot. We recommend spreading funds across multiple exchanges—which TokenBot makes easy to manage.
Is my personal information secure?
Section titled “Is my personal information secure?”Yes. We store minimal personal data, all encrypted. We never sell data to third parties.
How do I report a security issue?
Section titled “How do I report a security issue?”Email security@tokenbot.com. We take all reports seriously and respond promptly.
Summary
Section titled “Summary”| Concern | Answer |
|---|---|
| Can TokenBot withdraw my money? | No |
| Are my API keys encrypted? | Yes, 256-bit AES |
| Can staff see my keys? | No |
| Can I revoke access instantly? | Yes, delete keys on exchange |
| What if TokenBot gets hacked? | Keys are encrypted, can’t withdraw anyway |
Next Steps
Section titled “Next Steps”Feel confident about security?
Still have questions?
Authentication Security
Section titled “Authentication Security”TokenBot supports multiple authentication methods, each adding layers of protection:
Sign-In Options
Section titled “Sign-In Options”| Method | Description |
|---|---|
| Email + Password | Traditional login with strong password requirements |
| Google OAuth | Sign in with your Google account |
| Twitter OAuth | Sign in with your X/Twitter account |
| Apple OAuth | Sign in with your Apple ID |
Passkeys (WebAuthn)
Section titled “Passkeys (WebAuthn)”TokenBot supports passkeys — a modern, phishing-resistant authentication method. Passkeys use biometrics (fingerprint, face) or device PINs instead of passwords.
Benefits:
- No passwords to steal or phish
- Tied to your device hardware
- Faster login experience
- Supported on all modern browsers and devices
Request signing (replaces 2FA)
Section titled “Request signing (replaces 2FA)”There is no password and no login step to protect with a second factor. Every request is signed with a secp256k1 key that stays encrypted on your machine, and the signature covers the method, path, timestamp, nonce and a hash of the body — so a captured request cannot be replayed against a different endpoint or reused after its window closes.
2FA and passkeys belonged to the retired web dashboard and have no current equivalent. See Authentication.