How to Connect a Trading Bot to Bybit with API Keys (Safely)

Connecting a bot to Bybit takes a few minutes, and the safety comes down to one setting: what the API key is allowed to do. Enable trading, disable transfers, and a leaked key can't cost you your balance. Here's the exact, safe way.

On Bybit, create an API key with Contract/Spot trading enabled and transfers/withdrawals disabled. Bind it to the bot's IP and a stolen key still can't move your funds.

On this page

What the key does
Create the key
The right permissions
Connect the bot
Staying safe
FAQ

What a Bybit API Key Does

An API key lets a bot place and manage orders on your Bybit account through Bybit's official interface — the same actions you'd take in the app, automated. It never exposes your password, and with the right permissions it can't withdraw your funds.

As always, prefer a non-custodial bot: your money stays on Bybit; the bot only trades.

Create the Key on Bybit

Log in and open Account & Security → API.
Click Create New Key → choose System-generated.
Set permissions (below), complete 2FA, and copy the key and secret — the secret shows once.

Let the bots trade while you don't

Prometheus runs a managed, risk-controlled strategy 24/7 on your own exchange — non-custodial, with a 90-day money-back guarantee.

Get Lifetime Access →

Set the Right Permissions

✅ Enable Spot and/or Derivatives trading (Contract) — so the bot can trade.
❌ Do not enable Withdrawals or internal Transfers.
✅ Bind the key to the bot's IP address so only that server can use it.

With transfers off, the key can trade but can never move money off your account.

Connect the Bot

Paste the key and secret into your bot, select Bybit and your market (spot or derivatives), and save. Prometheus shows its server IP to bind, connects in one click, and can start in demo mode so you confirm everything works before going live.

Staying Safe

Keep withdrawals/transfers disabled on the key.
Use IP binding and account 2FA.
Delete the key instantly if anything looks wrong — access is revoked, and funds were never at withdrawal risk.

Frequently Asked Questions

Is it safe to connect a bot to Bybit?

Yes, if the API key has trading enabled but withdrawals/transfers disabled and is bound to the bot's IP. In that setup the bot can trade but can never move funds off Bybit.

What Bybit API permissions does a bot need?

Spot and/or derivatives (contract) trading, with withdrawals and transfers left off, plus IP binding. That's all a bot needs to trade and nothing it needs to move money.

Can a leaked Bybit API key drain my account?

Not if transfers and withdrawals are disabled on that key — it can only place trades. Bind it to the bot's IP and delete it if you're ever unsure.

This article is for information only and is not financial advice. Cryptocurrency trading involves substantial risk of loss and is not suitable for everyone. Past performance does not guarantee future results. Never trade money you cannot afford to lose.