Quickstart: bot trading

Set up a bot and sign your first transaction.

Prerequisites

• A bot user set up in the Fortkey console, and its user_id.
• The wallet_id of the wallet you want to trade with.
• The bot's authentication private key (this is not a wallet key; it only authenticates the bot to the platform).
• The bot has wallet access under your access policies.
• Optionally, the Bot SDK installed (Rust or TypeScript).

Trading with the SDK

The SDK handles authentication and signing so you do not have to manage raw HTTP requests. Refer to the SDK repository README for the latest usage.

use fortkey_sdk::user::{Bot, UserId};
use fortkey_sdk::sign::SignatureRequestKind;

let user_id = UserId::new(String::from("YOUR_BOT_USER_ID"))?;
let wallet_id = "YOUR_WALLET_ID";
let private_key = String::from("YOUR_PEM_PRIVATE_KEY");

// Optional: override API endpoints for your deployment.
// Endpoint hostnames for your deployment are provided during onboarding.
// let base_url = String::from("https://api.fortkey.io");     // main API
// let signing_url = String::from("https://sign.fortkey.io"); // latency-routed signing

let bot = Bot::new(private_key, user_id, None, None)?;

// Challenge-response login. Pass true to auto-refresh the session token.
bot.login(true).await?;

// Decode + policy check + signature, one round trip.
let tx_hex = String::from("YOUR_TRANSACTION_AS_HEX_STRING");
let signature = bot
    .sign_transaction(wallet_id, SignatureRequestKind::Transaction, tx_hex)
    .await?;

A TypeScript SDK is available with the equivalent flow; see its repository README.

Trading without the SDK

If you prefer raw REST, the flow is: authenticate with the challenge-response protocol (see authentication.md), then call the signing endpoint with your session token. All available bot endpoints are listed in the OpenAPI specification; the signing endpoint is the one you will use most.

POST /auth/login   -> receive a one-time challenge
POST /auth/cra     -> exchange the signed challenge for a session token
POST /sign         -> submit an unsigned payload, receive a policy-checked signature

Next steps

• Route signing to the region closest to your venue: multi-region-signing.md
• Restrict what the bot can sign: policy-engine.md