Security

Skyrexio is non-custodial. Your money never moves to Skyrexio. It stays on your exchange account, and Skyrexio only sends trading orders through the exchange API with the permissions you give it. This page explains what protects you and what you can do to protect yourself further.

Your funds stay on the exchange#

Skyrexio cannot withdraw your money, because it never asks for the permission to withdraw. The worst a connection can do is place or cancel orders, and only within the permissions of the key you created. You can remove access at any time on the exchange itself.

API keys#

• Keys are stored encrypted.
• Create keys without withdrawal permission. Give a key only the rights to read the account and to trade. If the exchange offers an option to enable withdrawals, leave it off.
• Use the IP whitelist where the exchange offers it. Binance, Gate.io, HTX, BitMart, XT and WEEX show the Skyrexio IP addresses in the connection window. Restrict the key to those addresses, and a stolen key will not work from anywhere else.
• Name keys clearly on the exchange, so you know which one belongs to Skyrexio.

Fast connect#

Most exchanges support fast connect: on the Fast API tab you press Connect, the exchange opens its own authorization page, you approve there, and the exchange creates the access itself. You never copy a key and a secret, so there is nothing to leak while copying. Fast connect is available for Binance, OKX, Bybit, KuCoin, Gate.io, HTX, BitMart and WEEX. Crypto.com, BloFin, XT and Bybit EU use an API key. See Connect an exchange.

Every money action needs your approval#

The agent cannot open a trade, start a bot or close a position by itself. Every such action first appears as a confirmation card, and it runs only after you press Approve. A typed "yes" in chat is not an approval. A card expires after 5 minutes on a real account, so an old card cannot be confirmed by accident later. The card shows whether the mode is REAL or DEMO. See Confirmations.

Bots are the exception by design: once you start a bot, it trades by its rules without asking each time. You decide when it starts and stops. A bot created through the chat is created switched off and needs a second approval to start.

Protect your account#

Open the account menu, then Settings:

• Enable 2FA adds a second step to logging in. Turn it on.
• Change password lets you set a new password. Use one that you do not use on other sites.
• Active sessions shows the devices where you are logged in. End any session you do not recognize, or press Terminate all other sessions.

The agent never asks for secrets#

The agent will never ask you for your password, API secret or 2FA code in the chat. If anything in the chat asks for them, do not send them. API keys are entered only in the connection window of the app. The agent does not store prices, balances, keys or personal data in its memory. You can see and delete what it remembers in Settings, What the assistant remembers.

If you think a key has leaked#

1. Open the exchange and delete the API key there. This stops all access at once.
2. Check your open orders and positions on the exchange.
3. Create a new key with the safe permissions above.
4. In Skyrexio open Accounts, open the menu of the account and choose Update API Key, then enter the new key.

If you also suspect your Skyrexio password, change it and look at Active sessions. Then write to support with Contact support in the account menu.

Next: API keys and Plans and limits.