Connect Your Exchange Safely: The Bring-Your-Own-Key Guide

CoTrading is bring-your-own-key (BYO). You connect your own exchange API credentials, and they stay on your machine — never uploaded, never logged. This guide covers how to create those keys safely.

Principle 1: Testnet before live

Always start on testnet. Testnet keys and live keys are stored in separate slots inside CoTrading, so they can never be mixed up. Practice the full workflow — chart analysis, plan review, approval — with play money until it feels routine.

Principle 2: Disable withdrawals on the API key

This is the single most important safety step. When you create an exchange API key, grant only the permissions CoTrading needs:

• Read account and market data
• Place and cancel orders (spot and/or derivatives, as you use)

And explicitly do not grant:

• Withdrawal permission

CoTrading enforces this: before you can switch a key to live trading, it verifies that withdrawals are disabled on that key. If the exchange reports the key can withdraw, the live switch is blocked. A key that cannot withdraw means that even in a worst case, funds cannot leave your account through CoTrading.

Principle 3: Bind to IP where possible

Many exchanges let you restrict an API key to specific IP addresses. If you use CoTrading from a stable network, adding an IP allowlist is a cheap extra layer: even a leaked key is useless from an unapproved address.

Step by step

1. Log in to your exchange and open the API management page.
2. Create a new API key labeled clearly, e.g. cotrading-testnet.
3. Enable read and trade permissions; leave withdrawals off.
4. Optionally add an IP allowlist.
5. Copy the key and secret into CoTrading's testnet slot.
6. Verify data loads and place a testnet order through an approved plan.
7. When ready for live, repeat with a live key (withdrawals off) in the live slot and pass the confirmation gates.

Why the AI never touches your keys

The AI process in CoTrading has no order-placing permission and no access to your raw credentials for execution. It proposes plans; the app — under your approval and the deterministic risk layer — handles order placement. Your keys sit behind that boundary.