algothDocs — Connect an exchange
Connecting Bybit to AlgoThink
How to create a trade-only API key on Bybit and add it to AlgoThink, without ever granting withdrawal permission.
AlgoThink trades on your own Bybit account through an API key you create yourself. It never holds your funds, and the key you give it is deliberately powerless to move money: you grant trading permission and leave withdrawals switched off, so the worst case is an unwanted trade, not a drained wallet.
Never enable withdrawal permission. AlgoThink does not have a withdrawal feature and never calls a withdrawal endpoint. Any tool asking for withdrawal rights on a trading key is asking for more than it needs.
1. Create the API key on Bybit
Open Bybit's API management page (their own walkthrough is here) and create a new key. What matters:
- Enable: Contract/derivatives trade permission. AlgoThink also reads your balance and your account's fee tier, so plain read access needs to be on too — that's usually granted automatically alongside trading.
- Leave off: withdrawals, transfers, and anything touching account management.
- IP restriction is optional. AlgoThink doesn't publish a fixed egress IP, so if you restrict by IP you may have to update it later; leaving it unrestricted is the simpler path.
Bybit's taker fee runs slightly higher than the other venues AlgoThink supports, which the paper-trading cost model accounts for automatically.
2. Copy your credentials
Bybit shows the API secret exactly once, at creation time. Copy it before you close the dialog. If you lose it, you can't recover it — delete the key and create a new one.
You'll end up with two values: an API key and an API secret.
3. Add them to AlgoThink
- Open Account in the sidebar.
- Go to the API keys & notifications tab.
- Find the row labelled
bybit API key, paste the key into the field, and press Save. - Do the same for
bybit API secret.
Saved values are never shown back to you — the row displays only the last four characters as a hint, so you can tell at a glance that something is stored without exposing it. Keys are encrypted before they reach the database and are only decrypted to make the specific call you authorized.
4. Switch to live mode
On the Account page's General tab, set Trade on to bybit, then press Switch to LIVE. AlgoThink runs a real authentication check against Bybit at this point — if the key is wrong or lacks trading permission, the switch is refused with the error the exchange returned.
Two things must already be true: 2FA is enrolled on your AlgoThink account, and you have no open positions.
What to expect after switching
- Live mode alone doesn't send orders. There's a second switch — Arm live trading on the Dashboard. Until you arm it, live mode is a dry run: intended orders are logged and alerted, nothing reaches Bybit. See how arming works.
- Arming re-checks your fees. AlgoThink compares your account's real taker fee against the cost assumption its validation used, and refuses to arm if your costs are higher.
- Removing a key disarms you. Clearing a saved key immediately disarms live trading. If you had open live positions, they stop being monitored for stop-loss and take-profit — you'd need to manage them on Bybit directly.
- You can revoke from either side. Delete the key on Bybit, or clear it in AlgoThink. Both take effect immediately.