Security at Bitsgap
Your Funds Stay On Your Exchange
Bitsgap is a non-custodial trading platform. We connect through trade-only API keys, never request withdrawal permissions, and reject any key that has withdrawal access enabled.
Encrypted API keys
Keys are encrypted with RSA-2048 before they leave your browser.
IP whitelist
Lock your key to Bitsgap IPs so it won’t work from anywhere else.
2FA on your account
Protects your Bitsgap login with a one-time code.
Revoke anytime
Disconnect in Bitsgap, then delete the key on your exchange.
Exactly what your API key allows
Permissions are controlled and enforced by your exchange. Bitsgap only needs access required to read account data and execute your trading instructions.
Read
Balances, open orders and trade history, so your dashboard and bots stay in sync.
Trade
Placing, changing and cancelling orders by your bot settings. Add futures access only if you run futures bots.
Withdrawal
Bitsgap doesn’t accept keys with Withdrawal enabled. Keep transfers and deposits off as well.
Your Side of Security
Bitsgap controls the connection. These three steps happen on your exchange.
Turn on 2FA on the exchange
Binance, Bybit and KuCoin ask for their own 2FA code when you create or change an API key. WhiteBIT requires 2FA before you can create one.
Delete the key on the exchange
Removing an exchange in Bitsgap deletes Bitsgap’s copy of the key. The key itself stays active on your exchange until you delete or revoke it there.
Close orders before you disconnect
Removing a key doesn’t cancel bots or open orders. Stop your bots first, and check open orders on the exchange.
How Bitsgap Connects to Your Exchange
Bitsgap sends trading requests. The exchange executes orders and holds your balance.
Create a key on your exchange
Use the permissions listed below for your exchange.
Add it in Bitsgap
Open My Exchanges → Add new exchange and paste the key.
Bitsgap checks the key
Permissions and IP restrictions are verified before the connection is saved. A key with the wrong access won’t connect.
The exchange executes orders
Bitsgap sends your bots’ orders, the exchange fills or rejects them, and Bitsgap syncs balance, orders and bot status.
FAQ
No. Bitsgap only requests read and trade permissions on your API key. Withdrawal is a separate permission we never ask for, and any key with withdrawal access enabled is rejected.
It can’t move funds off the exchange, but if it leaks it can still expose your balance and trade history, or place unwanted trades within its scope. Restricting the key by IP and enabling 2FA closes that gap.
Delete the API key in your exchange account. Access is cut off immediately — nothing needs to happen on Bitsgap’s side, and any open positions stay open until you close them separately.
Your funds stay untouched. Bitsgap never holds your crypto — an outage only pauses new bot instructions. Any stop-loss or take-profit orders already placed on the exchange still trigger normally.
See how Bitsgap worksBefore connecting real fundsUse Demo mode to explore the platform and understand bot behaviour using simulated funds and live market data.
*No credit card, KYC and exchange account