A practical checklist for non-custodial trading beginners

Non-custodial trading with an AI agent means your funds remain in a wallet you control, and the agent can only place orders within limits you define. It cannot withdraw funds to itself or to any address you have not explicitly approved. This setup lets you automate stocks, crypto, perpetual futures, options, and prediction markets through one API while keeping full custody. The following checklist covers the steps a beginner should complete before allowing an agent to trade real capital.

What does non-custodial trading actually mean?

In a custodial setup you send funds to an account controlled by a third party, then ask that party to trade on your behalf. This creates a counterparty risk: if the platform freezes withdrawals, misallocates assets, or suffers a breach, your capital is trapped. Felix uses a non-custodial model by construction, which means your capital stays in a wallet you own and the agent receives a scoped API key that can only spend within boundaries you set. The agent never sees your private wallet seed, and it cannot move assets to an unapproved withdrawal address even if its logic is compromised or its key is stolen. Because the system routes orders through a single API across stocks, crypto, perpetual futures, options, and prediction markets, you do not need to create separate custodial accounts at each venue or trust multiple intermediaries with your deposits.

The API translates your plain USD order size into the contract math required by the underlying market, so you are not forced to learn each venue's margin notation, lot size, or tick value before you automate. You retain the ability to revoke access, adjust limits, or withdraw funds independently of the agent's activity. This separation of execution from custody is the core difference between giving an agent trading permission and giving an entity your money.

Which safety controls should you set before the first order?

Beginners should treat safety controls as mandatory infrastructure, not optional extras. A scoped API key restricts the agent to specific actions, such as placing orders or reading balances, and excludes broad administrative permissions. A scoped key should also be bound to the specific markets you intend to trade, so a key meant for prediction markets cannot accidentally route orders to a perpetual futures venue. This containment prevents configuration drift and limits the blast radius if a prompt injection or logic error causes the agent to attempt an unintended action.

• ·Scoped keys that limit which markets and actions the agent can access.
• ·Budget caps in US dollars that prevent the agent from exceeding the capital you allocate.
• ·Position limits that restrict concentration in any single instrument.
• ·Exit plans that define when the agent must close a position.
• ·A panic or kill switch that flattens all positions and revokes the key instantly.

You should document these limits in a configuration file or dashboard before you generate the key, not after the agent is already connected. Changing limits while the agent is active can lead to race conditions where an old order slips through before the new cap takes effect. It is safer to start with a conservative profile, test it in paper trading, and tighten or loosen individual parameters once you have observed how the agent behaves under real market conditions.

how to build guardrails for a trading agent covers these controls in detail, and how a single API keeps AI trading agents safe by design explains why centralizing them through one interface reduces the surface area for mistakes.

How do you connect an agent without exposing your keys?

Agents connect through MCP tools in AI code editors like Claude or Cursor, or through the REST API directly. In either case you generate a scoped key from your wallet dashboard, assign its permissions and limits, and hand only that key to the agent. The key is not your wallet's private seed, so revoking it does not affect your underlying funds or require you to rotate wallet addresses. You can test the connection in paper trading mode, which uses simulated balances and mimics the live order flow without touching real capital. When you are ready to trade real money, you must explicitly authorize the key for live access; the system does not default to live trading. This two-step process ensures that an agent cannot accidentally or maliciously escalate from observation to real money without your approval.

If you are using MCP tools, the agent interacts with the API through function calls defined in the MCP server. The agent does not store the key in its context window permanently; it requests the tool when needed. If you are using the REST API, you manage the key in your own code and should store it in a secrets manager rather than in plain text. In both cases, you should rotate the key after major testing milestones, and you should never share the same scoped key across multiple unrelated agents. Each agent deserves its own key with its own limits so that a bug in one does not consume the budget of another.

Before you connect, verify that the agent's prompt or instructions contain no hardcoded wallet keys, no instructions to override your limits, and no requests to reveal the scoped key back to the user or to an external server. Prompt injection is a real risk, and a well-scoped key is your best defense against an agent that has been tricked into acting against your interests.

How should you size positions and set budgets?

One of the most common beginner mistakes is letting an agent calculate position size in raw units or leverage multipliers without a clear dollar ceiling. Felix normalizes this by accepting orders in plain US dollars, so you can state that you want to risk fifty dollars on a stock position or two hundred dollars on a perpetual future, and the API handles the venue-specific contract sizing. You should still set hard limits at the key level. A daily or weekly budget cap prevents the agent from exhausting your allocated capital in a short window, while a per-position limit stops it from scaling into a single trade that could wipe out the budget if the market moves against you.

Think of your total trading capital as a pie, and the agent's budget as one slice. That slice should be small enough that losing it entirely does not change your financial plans. Within that slice, no single position should consume more than the per-position limit you configure. If you are starting with limited capital, how to start an AI agent with a small budget offers a framework for keeping each bet small enough to survive normal volatility. Remember that markets can gap, liquidity can thin out, and slippage can turn a calculated risk into a larger loss than expected. Sizing in USD simplifies the mental model, but it does not remove the underlying risk that trading can lose money, including everything you allocate.

You should also decide whether the agent is allowed to carry overnight positions or if it must flatten before a specific time. Overnight gaps in stocks or funding rate changes in perpetual futures can alter the risk profile of a position while you are not monitoring the agent. Adding a time-based exit plan or a drawdown trigger inside your key limits ensures that the agent does not silently accumulate risk while you are away.

What is the difference between paper trading and live trading?

Paper trading is a simulated environment where the agent submits orders against market data, and the system tracks hypothetical profits and losses without using your real funds. It exists so you can test every guardrail, observe how the agent behaves under volatility, and confirm that your panic switch actually flattens positions and revokes the key. The API shape is the same in both modes, so switching from paper to live does not require rewriting logic or changing the agent's instructions. This parity is important because it means the only variable that changes is the authorization state of your key.

Live trading requires explicit owner authorization of the key, which is a deliberate toggle in your dashboard. Do not skip paper testing. A beginner who verifies that the kill switch works, that budget caps are enforced, and that the agent respects position limits in simulation is far less likely to discover a configuration error when real money is at stake. You should also simulate failure modes during paper trading. Manually trigger the panic switch while positions are open, attempt to exceed the budget cap with an oversized order, and verify that the API rejects the request. If these tests do not behave exactly as you expect, fix the configuration before authorizing live access.

How do you keep an agent from locking you out of your own capital?

Even a non-custodial system requires you to plan for failure. If the agent enters a loop, misreads a signal, or encounters a bug, the panic switch is your last line of defense. It flattens all positions and revokes the scoped key in one action, cutting the agent off from further activity without affecting your underlying wallet or funds. Because withdrawal addresses are owner-approved only, the agent cannot send money to itself or to an external destination you have not whitelisted. This architecture limits the blast radius of a compromised or malfunctioning agent to the budget you scoped for that key.

Still, trading can lose money, including the entire budget allocated to the agent, so you should never authorize live trading without understanding that downside. The panic switch closes positions, but it closes them at market prices, which may be worse than your intended exit if volatility is high. You should test the switch in paper mode to see how quickly it executes and whether it leaves any residual exposure. how trading with an agent changes security from first principles walks through the threat model in more detail, including how scoped keys, budget caps, and owner-approved withdrawals work together to keep custody where it belongs.

Review your authorized withdrawal addresses regularly. If you no longer use a particular address, remove it from the whitelist. If you upgrade your wallet software or rotate keys, generate a new scoped API key for the agent and retire the old one. These habits are the operational equivalent of changing passwords: they reduce the window of opportunity for any attacker who might have obtained an old key or an old address list. Non-custodial safety is not a one-time setup; it is a practice of continuous boundary maintenance.

Frequently asked questions