Connecting Your Exchange
Creating a Bybit API key, handing it to the bot from your account page, and taking it back.
Connecting is one thing: giving the bot a Bybit API key so it can place and manage orders for you. It never sees your Bybit password, and a key made the way this page describes cannot move money off Bybit at all.
It happens on the website, and only there. The bot has no Setup screen and no way to take a key in a chat - a credential typed into Telegram sits in a message history on your phone, on Telegram's servers, and in whatever backup either of them keeps. The web form encrypts it in your browser before it is sent anywhere.
Two settings on the key are not the obvious ones, and both fail in a way that reads like a bad key rather than a misconfigured one:
- The IP allowlist wants this server's address, not yours. The calls come from the bot's server. A key locked to your own laptop is rejected on the first request.
- The permission that lets the bot trade is
ContractTrade, under Unified Trading. Bybit hands out aDerivativesscope on keys that cannot place a single derivatives order, so the presence of the word "derivatives" is not the thing to check.
Where to do it
Open your account page, find the bot you want to connect, and press Connect Exchange under exchange key. Sign in first if you are not already - the bot's own menus link you there, and the account you sign in with is the one your Telegram is linked to.
Your key is encrypted before it leaves your browser
The website you type it into cannot read it. Your key and secret are encrypted in the browser with a public key the bot server hands out, so what travels to our web servers is something only the bot server can open - it is decrypted there, checked against Bybit, and stored encrypted.
What that does not mean: your own browser still sees what you type, and the bot server still holds the key that reads it. It takes the website out of the list of places your secret exists, and that is the whole of it.
The Exchange field lists Bybit, Binance Futures and OKX, and only Bybit can be picked - the other two are greyed and marked soon. They are there so the list answers the question you actually have, which is which exchanges Risbot will run on, rather than showing one row and no hint that the answer changes. Rotating a key locks the field entirely: the venue belongs to the bot the key is on, and swapping it is not something this form does.
The form expires. It is good for fifteen minutes and can be submitted once - open it, paste, send. If you leave it sitting it will tell you to start again, which costs nothing.
Create the key on a sub-account, not your main one
This decides which account the key belongs to, and advice about that arriving after the key exists is advice arriving too late.
A Bybit sub-account cannot withdraw at all. Funds have to be moved to the main account first, and only you can do that. So a key created on a sub-account, holding only what you want the bot to trade, cannot take money off Bybit even if someone else gets hold of it.
Creating the API key on Bybit
The screenshots below were taken as this was written. Bybit changes its site without notice, so a label may have moved by the time you read this - the settings to look for are the same.
-
On your account page, find the bot and press Connect Exchange under exchange key
-
The connect form opens with the address to allowlist at the top. Keep it open - you will paste the key into it at the end
-
Open Bybit's API Management page (Profile → API) and press Create New Key
-
Choose System-generated API Keys
-
Fill in the key's details:
-
API Key Usage: API Transaction
-
Name it anything you like
-
Permissions: Read-Write
-
Tick Only IPs with permissions granted, and add this IP:
188.166.164.205It is the same address the connect form from step 2 prints under Allowlist this IP on the exchange, and the button beside it there copies it.
-
-
Under Unified Trading tick: Orders, Positions, USDC Derivatives Trading, SPOT Trade
-
Leave Withdrawal and Assets unticked - the bot never needs them, and a key without them cannot move funds - then press Submit
-
Confirm it's you. Bybit asks for the security checks your Bybit account has turned on - here, a code sent by email and a Google Authenticator code
-
Copy the API Key and the API Secret. Bybit shows the secret only on this screen - close it first and you have to make a new key
-
Paste both into the connect form and press Connect key
-
Once Bybit accepts the key, the exchange key row names Bybit, the key, and what it may do
The form calls Bybit while you wait - it says checking with Bybit beside the button - because a key is only counted as connected once Bybit has answered to it. If Bybit refuses, the button becomes Try again and the reason appears above the fields, with everything you typed still in place.
The IP is the server's, not yours
Bybit asks which addresses may use the key, and the obvious answer - the machine you are sitting at - is the wrong one. Every request comes from the bot's server, so that is the address the key has to allow.
A key bound to anything else is refused by Bybit on the very first call, with an error that looks like a wrong key rather than a wrong allowlist.
Why SPOT Trade, when the bot trades perpetuals
It is not used yet - the bot trades linear perpetuals only - and it is asked for now because Bybit does not allow permissions to be added to a key after it exists. Ticking it costs nothing and saves replacing the key the day spot trading arrives.
Connect proves the key before the account counts as connected
Connect calls Bybit for your wallet balance with the credentials you just gave it. Only if that call succeeds is the account marked connected - a stored key alone is never enough, because a key Bybit rejects would otherwise sail past the gate and produce raw exchange errors on every later screen.
A failure is reported on the form itself, with the reason, and the account stays disconnected. The form stays open with everything you typed still in it. Three failures account for nearly everything:
Bybit refused this key because it is bound to an IP allowlist this server is not on. Add the address below under API management, then try again.Bybit rejected these credentials: <Bybit's own reason>Could not reach Bybit: <what went wrong>The first is by far the most common first attempt. The form shows the address to add from the moment it opens - in a row of its own with a button that copies it - because the allowlist has to hold it before the key is ever used, not only before it connects. When this is what was refused, that block turns red, so the sentence says what happened and the block says where to act. Paste the address into the key's IP allowlist in Bybit, then press Try again. On the rare occasion the server cannot work out its own address, the block is left out rather than drawn empty and the refusal says so - remove the allowlist from the key, or ask us for the address.
The second is Bybit's own wording, passed through unedited. The third means the call never got an answer - nothing is wrong with the key, and pressing Try again is the right response.
If Bybit refuses the server's address later
An allowlist can change after a key connects - an address edited or removed in Bybit, or the key restricted after the fact. When a page on the website asks Bybit about one of your bots and Bybit refuses because the server's address is not on that key's allowlist, a red bar appears at the top of every signed-in page, naming the bot. It carries the address to add and a button that copies it, and a link to Bybit's API Management.
There is one bar per bot, so if two bots' keys are refused you see two. A bar has no close button: it stays until that bot's key is accepted again. Each page you open while a bar is up asks Bybit again, so once the address is on the allowlist the bar goes on the next page you open. Revoking the key also removes it.
One exchange account, one bot
The moment a key connects, the bot records which Bybit account answered - Bybit's own account id - and refuses to let a second bot drive the same one. If the clash is with another account of your own, it names the bot to go and disconnect from:
This exchange account is already connected on bot 2. One exchange account can only be linked to one bot - disconnect it there first.If it is connected by somebody else, no bot is named, because saying where a stranger's setup lives would report it back to whoever happens to be holding a key:
This exchange account is already connected by another user. One exchange account can only be linked to one bot.Matched on the account, not the key
One Bybit account can mint any number of API keys, so comparing keys would wave the second one straight through - which is exactly how someone would arrive here without meaning to, by making a fresh key for a second bot.
Two bots on one exchange account would each believe they owned it: two daily loss guards means the real cap is doubled, both size positions against the same wallet balance as though all of it were theirs, and the trade history splits in two so neither side's Performance is complete.
What connected looks like
The key row on your account page names the exchange, what Bybit calls the key, when it was connected, and the permissions the exchange granted it - in Bybit's own words rather than translated, so a scope this bot has never heard of is still reported accurately.
A key the exchange will not let place derivatives orders says so on that row. That is not a bot limitation: Bybit does not let permissions be added to a key after it is created, so a read-only or spot-only key has to be replaced.
`Derivatives: DerivativesTrade` is not permission to trade
A spot-only key reports that scope too. The one that matters is ContractTrade carrying
both Order and Position. If you read the scope list yourself, that is the line to read.
The bot's home screen changes too. It names the exchange and that exchange's own name for the key, and its header turns to Ready 🟢 - which it only does once nothing at all is stopping this bot from placing an order:
Until then it reads Unprepared 🟠 and says which line is the reason:
Changing a key
The key row has a menu: Rotate key replaces it, Revoke key removes it.
Rotating removes the old key first and then checks the new one. If the new one is refused, the bot is left with no key rather than with one nobody proved - so have the new secret in front of you before you start, because Bybit shows it only once.
Revoking is not the same as pausing, and the difference matters if you run more than one bot: revoking gives the key slot back to your plan, so another bot can use it immediately. Pausing keeps the slot, because resuming has to be able to work. Everything else about a revoked bot is untouched - its settings, its guardrails and its whole history stay exactly as they are, and it goes on checking every signal against them.
Revoking
What goes is the credentials - the API key and secret, deleted from the bot, and the connection with them.
What stays is everything else. Revoking is removing an exchange, not deleting an account:
| Kept | Removed |
|---|---|
| Risk Management settings, the daily loss limit, trading days | The stored API key |
| Sniper presets and your symbol list | The stored API secret |
| Every trade in your history, and your notification and app lock settings | The connection itself - the bot goes back to rules only |
Reconnecting is the same flow as the first time, with one difference worth reading before you tap rather than after: Bybit shows a secret once, when the key is created. It cannot be looked up again, so unless you saved it somewhere, reconnecting means creating a new key.
Open positions are not closed
Revoking removes the bot's access, not your trades. Anything already open on Bybit stays open - and stops being managed, because the bot no longer has the credentials to manage it. Check your positions on Bybit before revoking with something running.
Every key in one place
Connections, in the sidebar of your account, lists every bot that holds a key: the exchange, what the exchange calls the key (its note, or its UID), when it was connected, and which bot it belongs to. A key the exchange says cannot place derivatives orders is marked there, and so is one whose permissions were never recorded.
Each row has Revoke, which is the same revoke as the one on the bot's own row. Revoke all above the list revokes the key on every bot at once, and asks first:
Every bot stops placing orders straight away and keeps everything else - settings, guardrails and history. The key slots go back to your plan.
Your Telegram link is not touched. Connecting and rotating stay on the account page, on each bot's row.
The other way a key is revoked
Unlinking your Telegram account revokes the key on every bot you own, all at once, with everything on this page applying to each of them. It has to: the bot server finds your bots through that link, so a key left behind by an unlink could never be revoked by anyone afterwards. The confirmation names every bot before it happens - see Unlinking.
If an operator disconnects your account
The people who run Risbot can remove your exchange connection from their own internal tools, separately from anything you do. This is not a routine action - it exists for cases like a leaked API key, where the connection has to be revocable even though you did not ask for it to be removed.
If your account was connected at the time, the bot sends you this message:
Open positions are not touched
Disconnecting only removes the bot's stored API key and secret - it does not close or otherwise touch anything already open on the exchange. Once the credentials are gone the bot has no way to manage or close those positions, so whatever was open stays open, unmanaged, until you either reconnect or act on it yourself in Bybit. If you get this message, check your open positions on Bybit directly rather than assuming the bot is still watching them.
If Bybit says the key no longer exists
The third way a connection ends is that you delete the key at Bybit, or it expires. The bot finds out the next time it calls the exchange, drops the dead credentials rather than leaving the account looking healthy, and tells you once:
Once, not on every panel afterwards - one deleted key should not become a stream of notifications. Everything under Revoking above applies here too, including the open positions.
Next
Your First Trade - building one trade by hand and seeing what it will cost before it is sent.