To place trades for you, Blockcircle needs a way to talk to your exchange. You give it an API key: a long code you create in your exchange account that lets software place orders. Your money stays in your own exchange account the whole time. Blockcircle never holds it.
Make the key trade-only
When you create the key, your exchange shows a list of permissions. Turn on reading and trading. Leave withdrawals off. With withdrawals off, the exchange itself will refuse any request to move money out, whoever sends it. That is why we can never withdraw your funds: the key we hold does not allow it.
On exchanges that tell us what a key can do, such as Binance and Bybit, Blockcircle checks and refuses any key that allows withdrawals. Some exchanges do not report this, so check the withdrawal box yourself every time.
Lock it to set addresses
Many exchanges let you limit a key to a list of IP addresses. If yours offers this, write to support@blockcircle.com for the addresses our servers use. A key that only works from those addresses is useless to anyone who copies it.
Wallet-based venues
On venues you sign into with a wallet, such as Hyperliquid, you approve a separate agent key. It can place trades. It cannot move funds out of your wallet.
How we store it
Your key is encrypted before it is saved, under a dedicated master key. It is used only to place and manage the trades your own rules ask for.
Things we will never ask for
- Your exchange password
- Your two-factor codes
- Your wallet's seed phrase or private key
- A key with withdrawals switched on
If anyone asks for these in our name, it is a scam. Contact support@blockcircle.com.
You can cut access at any time
Delete the key in your exchange account and access stops that second. You can also disconnect the exchange under Connected Accounts. A good first step is to connect, then run your rules in practice mode for a week before you let them trade with real money.