A practical checklist for non-custodial AI trading

Non-custodial AI trading means an agent can place trades with real money while the funds stay in a wallet you control, and the agent can never withdraw to itself. A practical checklist for doing it safely has five parts: verify the custody model, scope the keys, set hard limits, test on paper, and prepare the exit before you need it. This article walks through each part in order, with concrete checks you can confirm before the first live order. Trading can lose money, including everything you allocate, so the goal of the checklist is to make every failure mode cheap and reversible.

What does non-custodial actually mean?

In a custodial setup, you deposit money into an account that a platform controls, and both you and your agent trust that platform to hold it. In a non-custodial setup, the funds stay in a wallet that you control. The agent receives a key that authorizes it to place trades within limits you define, but the key cannot move money to an address you have not approved. The agent can spend within its budget, and it can never withdraw to itself.

This separation matters because it changes the worst case. If the agent misbehaves, hallucinates, or gets compromised, the damage is bounded by the budget and position limits you set, not by your total balance. We covered the custody model in more detail in non-custodial trading for AI agents. The short version is that custody answers one question: who can move the money, and to where.

Have you verified the custody model?

Before funding anything, confirm each of these properties directly, from the actual key and wallet configuration rather than from marketing copy.

• ·Funds sit in a wallet you control. You can see the balance yourself, and no platform holds it on your behalf.
• ·The agent's key can place and cancel orders, and nothing else. It cannot add withdrawal addresses, change account settings, or create new keys.
• ·Withdrawal addresses are approved by you, out of band from the agent. The agent has no path to influence that list.
• ·You can revoke the key at any time, from an owner-only interface, without any cooperation from the agent.
• ·Paper trading is available so you can run the full workflow before real money is involved.

If any one of these fails, stop. An agent that can change its own withdrawal destination is not non-custodial in any meaningful sense, regardless of what the documentation calls it.

Are your keys scoped and your limits hard?

A scoped key is a credential that can only do what you explicitly allow. With Felix, one key can reach stocks, crypto, perpetual futures, options, and prediction markets through one API, but you decide which of those markets a given key may touch. An agent that only needs to trade crypto spot should hold a key that cannot open a perps position or buy an option.

Limits come in two kinds, and the difference matters. Soft limits live in the agent's instructions: text in the prompt that says do not spend more than some amount. Hard limits live in the infrastructure, enforced when the order arrives, independent of what the model decides. Soft limits fail whenever the model misunderstands, loops, or gets manipulated by something it reads. Hard limits fail only if the infrastructure fails. Put every limit that matters in the second category.

The hard limits worth setting before the first trade:

• ·A budget cap: the total the key is allowed to spend, denominated in dollars.
• ·A per order maximum, also in dollars, so a single bad decision cannot consume the whole budget.
• ·Position limits per market, so the agent cannot concentrate everything in one instrument.
• ·The list of allowed market types, matched to what the agent is actually supposed to do.
• ·An expiry on the key, so access ends by default unless you renew it.

Orders on Felix are sized in plain US dollars, and the API normalizes venue specific contract math behind the scenes. That makes dollar denominated limits natural to reason about: a 500 dollar cap means 500 dollars of exposure, whether the underlying instrument is a share, a coin, or a perpetual contract.

Did you test on paper first?

Paper trading runs the same agent, the same key logic, and the same order flow against simulated fills, with no money at risk. It exists to answer a specific question: does the system you actually built behave the way you think it does. Run the exact configuration you intend to deploy, with the same prompts and the same limits, and watch it long enough to see a full cycle of decisions.

What you are looking for is not whether the paper PnL is positive. Paper results do not predict live results, and trading can lose money either way. You are checking mechanics: are order sizes what you expected, does the agent respect its instructions, do rejections surface as errors the agent handles gracefully, and does the agent stop when it should. A paper order through the REST API looks like this: The exact request schema is in the docs; this example shows the shape.

curl -X POST https://api.felix.trade/v1/orders \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "market": "crypto",
    "symbol": "BTC-USD",
    "side": "buy",
    "amount_usd": 250,
    "paper": true
  }'

The same tools work over MCP, so an agent running in Claude, Cursor, or another MCP client can place paper orders through the same interface it will use live. When you do go live, that transition requires an explicit step: you authorize a specific key for live trading. No agent should drift from paper to live because a default changed somewhere.

What do you watch once the agent is live?

Going live is not the end of the checklist. It is the start of a monitoring routine, and the routine should be decided before the first order, not improvised after the first surprise. We wrote a fuller operational guide in how to run an AI trading agent with real money, safely. The core of it is a short list of things to check on a fixed cadence.

• ·Open positions versus position limits. The agent should never sit at the boundary of every limit at once.
• ·Cumulative spend versus the budget cap, so you know how much room is left.
• ·Order rejections and errors. A rising rejection rate means the agent is attempting things you did not allow, which is useful information even when the limits hold.
• ·The agent's reasoning or logs, sampled regularly, to confirm it is still executing the strategy you authorized rather than something it drifted into.
• ·Concentration: whether a few positions dominate the book, even if each is individually within limits.

Pick a cadence you will actually keep. Daily review is reasonable for an active agent. Weekly is reasonable for a slow one. The important property is that the review happens on a schedule, not only when something feels wrong.

What is your exit plan?

Every position the agent opens should carry an exit plan: the conditions under which it gets closed, decided in advance rather than negotiated with the position later. Above the per position plan, the whole setup needs a panic switch. Felix includes a kill switch that flattens open positions and revokes the agent's access in one action. It exists for the moment when you want the agent stopped now, not after it finishes its current reasoning loop.

Decide your triggers before you need them. Suppose the agent loses some fixed fraction of its budget, or starts placing orders outside the hours you expected, or its logs stop making sense. Write down what you will do in each case, and make sure you can actually do it: you know where the kill switch is, you can reach it from your phone, and you have rehearsed it once on a paper setup. An exit plan you have never tested is a hope, not a plan.

The checklist in one page

Everything above, compressed into the order you would actually work through it:

1. 01Confirm the funds live in a wallet you control, not a platform account.
2. 02Confirm the agent's key can trade but cannot withdraw, and that withdrawal addresses are owner approved only.
3. 03Scope the key to only the market types the agent needs.
4. 04Set hard limits in the infrastructure: budget cap, per order maximum, position limits, key expiry.
5. 05Run the full agent on paper trading and verify the mechanics, not the returns.
6. 06Authorize a specific key for live trading, deliberately.
7. 07Set a fixed monitoring cadence covering positions, spend, rejections, and logs.
8. 08Attach an exit plan to every position and test the kill switch before you need it.

None of these steps is exotic, and that is the point. Non-custodial trading with an AI agent is safe in proportion to how boring the setup is: bounded keys, hard limits, tested exits, and a custody model where the worst case is losing the budget, never the wallet. If you are still deciding whether an agent should trade for you at all, start with what is agentic trading and come back to this checklist when the answer is yes.