Security Best Practices

Bankr has two layers of safety controls: wallet-level (configured at bankr.bot → Security; applies to every surface) and per-API-key (configured at bankr.bot/api-keys; applies to one key). Both run independently — a transaction must satisfy both to broadcast.

Secure Your Account

If you're building on Bankr — or just trading with it — do these things. Each is an independent layer, so an attacker has to defeat all of them.

1. Turn on MFA on your social login

Your Bankr account is reached through the login you chose (X, email, etc.). Harden that login first.

X (Twitter):

1. In X, open Settings and privacy → Security and account access → Security.
2. Best: under Passkey, choose Manage passkeys and add a passkey (biometric or hardware-backed).
3. Otherwise: under Two-factor authentication, enable an authentication app or security key.
4. Avoid text-message (SMS) 2FA. Phone numbers are the weakest factor — SIM-swap attacks bypass them. If SMS 2FA is on today, replace it with an app or key.
5. Optional: enable Password reset protect under Additional password protection, so a password reset requires confirming your email or phone.

Email login: turn on MFA with your email provider (Google, Apple, etc.) — again a passkey or authenticator app, not SMS.

2. Turn on MFA in your Bankr account

This is a second, independent gate. Even if your X account is compromised, your Bankr account stays accessible only to you.

1. Go to bankr.bot, click your profile in the lower-left corner, and choose Security.
2. Under Multi-factor authentication, click Add passkey and follow your device's prompt (Touch ID, Face ID, Windows Hello, or a hardware key).
3. Require MFA turns on by default once you add your first passkey. You'll verify the passkey as it's enabled, so you can't lock yourself out with a factor that doesn't work.

Once on, your passkey is required to sign in and to change any security setting. Details: Bankr Terminal → Passkey MFA.

3. Turn on transaction guardrails

On the same Security page (profile in the lower-left corner → Security), cap what any session can do even if it's somehow compromised:

• Daily spending limit and per-transaction limit — bound total outflow in USD.
• Permitted recipients — transfers can only target addresses you've allowlisted; new entries wait out a cooldown.
• Price impact protection — reject swaps that would fill far below market value.
• Disable arbitrary contract calls — block raw contract interactions if you don't use them.

While you're there, review Active sessions and log out any device you don't recognize. Full reference: Bankr Terminal.

4. Scope any API keys you generate

If you create an API key at bankr.bot/api-keys, give it only the access it needs:

• Enable only the surfaces the key uses. The permission flags are independent — a key that only calls the LLM Gateway needs just gateway access; leave wallet, agent, and token-launch access off.
• Keep read-only on (the default) unless the key must transact.
• Set the IP allowlist so the key only works from your servers.

Full guidance and reference: API Keys.

Pick a layer

You are…	Read
Using Bankr through chat at bankr.bot	Bankr Terminal
Building an agent or integration with the API	API Keys
Doing both	Both — controls compose

For the full reference of API-key flags and error responses, see API Keys.

Where each control lives

Control	Configured at	Layer
Passkey MFA (login gate + step-up)	bankr.bot → Security	Wallet
Pause all transactions	bankr.bot → Security	Wallet
Daily USD limit	bankr.bot → Security	Wallet
Per-transaction USD limit	bankr.bot → Security	Wallet
Permitted recipients (with cooldown)	bankr.bot → Security	Wallet
Price impact protection	bankr.bot → Security	Wallet
Disable arbitrary contract calls	bankr.bot → Security	Wallet
Response channels (X, Farcaster)	bankr.bot → Security	Wallet
Active sessions (per-device logout)	bankr.bot → Security	Wallet
Read-only mode	bankr.bot/api-keys	API key
IP allowlist	bankr.bot/api-keys	API key
Recipient allowlist	bankr.bot/api-keys	API key

Stay Safe: How Bankr Will (and Won't) Contact You

Most account losses come from social engineering, not protocol bugs. Hold these rules:

• Bankr will never DM you first. Unsolicited DMs on X, Telegram, Discord, or Farcaster claiming to be "Bankr Support" are scams — even if the handle looks right. Real support flows through email (support@bankr.bot), the Discord support channel where you open the ticket, or in-app.
• Bankr will never ask for your seed phrase, private key, or password. Privy embedded wallets are non-exportable by design — there is no seed phrase to share. Anyone asking is an attacker.
• Bankr will never ask you to "verify" by signing a transaction or visiting a link. Verification happens server-side; you don't need to sign anything to prove ownership of your account.
• Bankr will never use a different domain. The terminal is bankr.bot, API is api.bankr.bot, docs are docs.bankr.bot. Anything else (bankrbot.io, bankr-claim.xyz, bankr.bot.fun, etc.) is fake.
• A token appearing in the launch feed is not an endorsement. Failed launches are routinely spoofed by scammers who deploy fake tokens with the same name. Verify the contract address from the creator's official channels before buying. See Token Launching FAQ for more.

If someone reaches out claiming to be Bankr, close the conversation and open your own ticket through the channels above.