Security: what the bot can and cannot do with your keys
Sync does not hold your money. The funds stay on your Bybit account, and the bot works through API keys that you create yourself and can revoke at any time in the exchange interface.
What the bot can do
- Place and remove orders on your account: entries, take-profits, stop-losses, grid and averaging orders.
- Read the balance, positions and order history — to check whether there are enough funds, to reconcile trades with the exchange and to calculate PnL.
- Change the leverage, the margin type and the position mode on futures when a trade requires it.
What the bot cannot do
- Withdraw funds or transfer them between accounts — the keys have no such permission, and the bot does not ask for it.
- Trade without your settings: the amount, the leverage, the stop and the trade limits are set by you.
- Work with a copy-trading master account key — such a key is rejected: “This API key belongs to a copy-trading master account. All your Grid/DCA orders would be automatically copied to your followers. Please use a regular account without copy-trading.”
Which permissions to give the key
| Bot type | Permission on Bybit | What not to give |
|---|---|---|
| Bybit Spot | Spot Trading | The withdrawal permission |
| Bybit Futures | Derivatives / Contract Trading (orders and positions) | The withdrawal permission |
Spot and futures need two different key pairs: one pair is tied to only one exchange bot. More on this in API key permissions, IP whitelist and the unified trading account.
IP whitelist
If the key was created without an IP restriction, the bot warns you once:
⚠️ API key without IP whitelist. Your API key works from any IP, which increases the risk if the key is compromised. We recommend adding to your exchange key settings IP whitelist — only our server IP.
In the same message the bot shows the address you need to add to the key settings on Bybit. This is not required — the bot works without a whitelist — but with it a stolen key is useless from any other address.
What the bot checks when you enter keys
- Exactly two values separated by a space: the key first, then the secret.
- The key length is 18 characters, the secret is 36. Otherwise: “Invalid API key length: 20 chars (must be 18). Copy the full key from Bybit, without extra spaces.”
- The pair is not registered yet: “This API key pair already exists in the system”.
- The key is valid and has the right permissions: “API keys do not have the required permissions”.
How to update or revoke keys
- You reissued the key on Bybit — bot card → Bot settings → Update API keys, send the new pair separated by a space. Updating API keys.
- You want the bot to lose access — delete the key in your Bybit account: without the key the bot cannot place a single order. The bot in Sync can be deleted once it has no active trades. How to change or delete an exchange bot.
- The key has expired — the bot reports: “API keys have expired. (You can update them in bot settings)”.
Extra protections
- The kill switch stops all Grid and DCA bots when the account draws down by the percentage you set. Kill switch.
- The external signal token (webhook) of a DCA bot is a password that starts the bot. Do not give it to anyone; if it leaked, tap 🔄 Rotate webhook token. Start from an external signal.
- A rate limit: no more than 30 requests per minute per user — protection against accidental queues of taps.
Common mistakes and what the bot says
- “API keys are invalid. (You can update them in bot settings)” — the key was deleted on the exchange or entered with a mistake. The key was not accepted or is invalid.
- “API keys do not have the required permissions” — the permission to trade on the required market is missing. API keys do not have the required permissions.
- “Failed to fetch balance from exchange. Check API keys and exchange connection.” — the key was revoked or the exchange is unavailable.