Automating Bybit and KuCoin Futures Without Giving Up Custody

Every automated trading product asks you for the same thing sooner or later: a way into your exchange account. What matters is not whether it asks, but what kind of door it asks you to open. A door that only lets someone place trades is one thing. A door that also lets them move your money out is another, and from the outside the two can look almost identical.

Here is the short answer. You can automate futures trading on Bybit and KuCoin without giving anyone custody by creating an API key that can trade but cannot withdraw, connecting that key to the software, and keeping your funds in your own exchange account the entire time. The software can open and close positions. It cannot send a single coin anywhere. Everything below is the long version of that sentence: what the permissions actually are, where people go wrong, and how to judge whether a setup is as safe as it claims to be.

What does “automating futures without custody” actually mean?

Start with where the money sits. When you trade perpetual futures on Bybit or KuCoin, your collateral lives in your account on that exchange. Nothing about automation has to change that. A trading bot is just another program that talks to the exchange, the same way the exchange’s own mobile app does. The only question is what that program is allowed to say.

Custody is the answer to a different question: who can move the funds. In a custodial arrangement, you send money to a company, a pooled wallet or a managed account, and the company trades on your behalf from there. You are trusting its security, its solvency and its honesty all at once. We wrote about that difference in detail in non-custodial vs custodial trading bots, and the short version is that the collapse of a custodian is a failure mode you inherit the moment you hand over the keys.

The non-custodial alternative uses the exchange’s own permission system. Instead of moving your funds, you give the software a narrow credential that can do one job. If the software disappears tomorrow, your money is exactly where it was this morning, in an account only you can withdraw from.

A good permission system turns trust into a setting you can inspect. You do not have to believe a promise about what the software will not do. You can look at the checkboxes.

How does a trade-only API key work on Bybit and KuCoin?

An API key is a pair of strings, sometimes with a passphrase, that identifies a program to the exchange and carries a list of things that program may do. Both exchanges let you build that list yourself when you create the key. Think of it as a hotel key card programmed for a single floor. It opens the doors you ticked and nothing else, and you can cancel it at the front desk without changing the locks on your own front door.

On KuCoin, the key has a general permission that covers reading account information, and a separate futures trading permission that allows order placement on the futures side. Withdrawal is its own permission, and it is optional. KuCoin also lets you restrict a key to specific IP addresses, and as Haas’s KuCoin setup notes describe, enabling the withdrawal permission requires an IP restriction to be switched on. A trade-only setup simply never ticks the withdrawal box. We walk through every screen of that process in our step-by-step guide to a trade-only KuCoin API key.

On Bybit the logic is the same, though the screens are organised differently. You choose between read-only and read-write access, and for a bot that places orders you need read-write. Inside that, you enable the contract permissions that let the key manage orders and positions on the derivatives side, and you leave the wallet permissions for transfers switched off. The Bitsgap helpdesk lays out the same pattern for its own users: read-write access, unified trading with contract orders and positions enabled, and account transfer and subaccount transfer left disabled. Exchanges rename and rearrange these options from time to time, so treat any written guide, ours included, as a map and check it against the screen in front of you.

The pattern is identical on both venues, even when the labels are not. Permission to trade on, permission to move assets off. Automation needs the first and never needs the second.

What can the software do with that key, and what can it not?

With a trade-only key, the software can read your balances and open positions, place and cancel orders, and close positions. That is the whole job description of an execution bot, and it is enough to run a systematic strategy end to end.

What it cannot do is as important. It cannot withdraw funds to an external address. It cannot transfer assets out of the account. It cannot change your login, your security settings or the key’s own permissions. If someone compromised the software provider tomorrow, the worst case on the exchange side would be unwanted trading on the account, which is serious but bounded. The worst case with a withdrawal-enabled key is an empty account.

That bounded risk is still real, and it is worth saying plainly. A key that can trade can also trade badly. Leveraged perpetual futures can lose money quickly, up to and including the entire balance of the account, whether a person or a program is placing the orders. Trade-only permissions protect you from theft. They do nothing to protect you from market risk, which is why the risk disclosure exists and why you should read it before connecting anything.

Security and risk are two separate questions, and confusing them is how people end up reassured about the wrong thing. A trade-only key answers the first. Only a sound strategy, sensible sizing and money you can afford to lose answer the second.

Why do some bots ask for withdrawal permission, and why should that end the conversation?

Sometimes a service genuinely needs funds to move, and it will tell you so. A product that rebalances across wallets, or one that sweeps profits to a cold address on your behalf, might ask for transfer rights. For a futures execution bot, the answer is almost always that it does not need them. Opening and closing perpetual positions on an account never requires moving collateral off the exchange.

So when a bot’s setup instructions tell you to tick the withdrawal box, even with a friendly explanation, treat it as a decisive signal rather than a minor configuration detail. A legitimate service built on non-custodial principles has no reason to ask for the one permission that turns a mistake or a breach into a total loss. We covered the wider pattern in our piece on crypto trading bot scam red flags, and the withdrawal request sits near the top of that list for a reason.

There is a quieter version of the same trap. Some products avoid the word withdrawal but ask you to deposit into an account or wallet they control “so the bot can trade faster.” That is custody under a friendlier name. If the money leaves the exchange account you opened in your own name, you are no longer in the setup described here, no matter what the marketing says.

The cleanest rule is also the simplest. If you cannot describe in one sentence where your funds are and who can move them, you do not have enough information to proceed.

What should you check before and after connecting a key?

Before connecting anything, open the key’s permission screen and read it as if you were an attacker. Ask what the worst action is that this key could take. If the answer is “place trades,” you are where you want to be. If the answer involves transfers or withdrawals, delete the key and start again. It takes a minute, and unlike most security advice it can be fully verified by you, on the exchange’s own page, without trusting anyone.

Name the key after the service that uses it. This sounds trivial until you have three keys from three different experiments and cannot remember which one is live. A clear name means you can revoke the right one in seconds, and it means a stray key from a tool you stopped using months ago does not sit around quietly with permissions you forgot you granted.

Treat the secret like a password. Both exchanges show the secret once, at creation. If you close the window without saving it, the fix is to delete the key and create a new one, which is annoying but also a feature, because it means nobody can quietly retrieve it later from the exchange’s side. Store it in a password manager, never in a screenshot, a chat message or an email to yourself.

Where a service publishes the IP addresses its software connects from, restricting the key to those addresses adds a second lock. A restricted key that leaks is useless to anyone connecting from somewhere else. Not every provider offers this, and it is not a substitute for leaving withdrawals off, but it is a sensible layer when it is available.

After connecting, look at the account itself rather than only the provider’s dashboard. The exchange’s own order history and position screens are the source of truth. If what the software tells you and what the exchange shows ever disagree, believe the exchange. And review your keys occasionally. A short list of keys you recognise is a healthier state than a long list of ones you do not.

Good security hygiene is mostly boring. It is a short permission list, a clear name and a secret that lives in one safe place.

Does it matter whether you use KuCoin, Bybit or both?

For the security model, no. Both exchanges support separate trading and withdrawal permissions, and the principle holds on either: trade on, withdraw off. AI Crypto Secrets currently runs on both KuCoin and Bybit, and the connection works the same way on each. You create a trade-only key on the exchange you prefer, connect it, and the funds stay where they are. The strategy is a systematic, rules-based trend-following approach, and it evaluates the market on a fixed schedule rather than reacting to every tick.

That fixed schedule matters for how you think about the key. The software is not hammering your account with thousands of orders a minute. It evaluates, and when its rules say so it opens or closes positions. A separate monitor watches margin conditions between those evaluations purely as a safety measure. Both use the same trade-only credential, and neither needs anything more.

Which exchange you pick is a practical decision about fees, interface, product range and what is available to you where you live. Those are your calls to make, and availability and rules vary by country and can change, so check the exchange’s own terms for your situation. Nothing in this article is legal or tax advice, and a trade-only key does not make any particular exchange available or appropriate for you.

One further point: using two exchanges gives you flexibility, not diversification of the strategy itself. A Pro plan can connect several accounts under one login, but the same rules run on each, so it is a convenience for managing accounts rather than a hedge against the strategy having a bad stretch.

Pick the exchange for the exchange. The permission model that keeps your funds yours is the same on both.

How is this different from a grid bot or a signal service?

Permissions describe how a bot connects. They do not describe what it does once connected, and the two are easy to blur. A grid bot, a DCA bot and a trend-following system can all run on the same trade-only key. What differs is the logic that decides when to buy and sell, and that logic determines how the account behaves in a trending market versus a choppy one. We compared the two main families in grid bots vs trend-following bots, and the short version is that they make opposite bets about what markets do.

A signal service is different again. It sends you instructions and you place the trades yourself, so there is usually no API connection at all. That keeps custody with you, but it also keeps the emotional work with you: acting on the third signal after two losers, at three in the morning, with real money on the line. Automation removes that step, at the cost of requiring you to grant a trading credential in the first place. The trade-only key is what makes that cost small.

Automation is not a promise of profit either. A rule-based system will have losing trades, sometimes many in a row, and trend-following in particular tends to lose small amounts often and win larger amounts less often. Connecting a key is a decision about execution. It says nothing about whether the strategy behind it will make money over any given period.

Separate the three questions every time: who holds the money, who decides the trades, and what happens when the decisions are wrong. A good setup answers the first clearly and is honest about the other two.

What happens if you want to stop?

Stopping is where non-custodial design pays off. To cut the software off, you delete the API key on the exchange. That is the whole procedure. Within moments the software can no longer see your account or place an order, and you do not need the provider’s cooperation, a support ticket or a notice period. The control sits with you, on the exchange’s side.

Deleting the key does not close positions that are already open. Those stay on your account until you or the software closes them, so the sensible order is to close or manage your positions first and revoke the key after, or to manage them manually on the exchange once the key is gone. It is worth knowing this before you need it rather than discovering it in a hurry.

Compare that with leaving a custodial service. You file a withdrawal request, you wait, and you hope the processing queue, the compliance review and the company’s liquidity all behave. The difference between revoking a key and requesting your money back is the difference between holding a switch and asking permission to use one.

The best test of a custody model is how easy it is to walk away. If leaving takes one click on a screen you control, the design is honest.

Where does this leave you?

Automating futures trading is a reasonable thing to want, and it does not require trusting a stranger with your money. The mechanism is in the exchange’s permission screen: trading enabled, withdrawals and transfers off, an optional IP restriction, a named key and a secret stored safely. That setup limits what the software can do to what you have chosen to allow.

It does not remove risk. Leverage amplifies losses, strategies go through bad stretches, and nothing here guarantees a result. If you want to understand how the strategy behind AI Crypto Secrets is built and tested, start with how it works, and read the risk disclosure before you connect any account. The part you control is the door. Make sure it opens only the way you meant it to.