Getting started5 min de lecture
Security and custody
What JW3 can and cannot do with your funds, what it stores, and how to lock your account down.
Pas encore disponible dans votre langue — version anglaise affichée.
The short version #
- JW3 never holds your funds. There is no JW3 wallet to deposit into.
- Wallet private keys are generated and used in your browser or your wallet app. They are
never sent to a server.
- Exchange API keys are stored encrypted and used only for the actions you request.
Withdrawal permission is neither needed nor recommended.
- Every credential you grant can be revoked, immediately, from Settings.
What JW3 stores #
| Item | Where it lives | Can it move funds? |
|---|---|---|
| Wallet private key | Your wallet, or your browser's encrypted storage for embedded wallets | Only when you sign |
| Exchange API key | Encrypted at rest, server-side | Only within the permissions you granted |
| Perp agent key (Hyperliquid, Aster) | Generated in the browser, encrypted on your device | Trade only — withdrawals are not possible |
| Session | Your browser, with a fixed lifetime | No |
| Access tokens (CLI, MCP) | Your device, hashed on the server | Only within the scopes you chose |
Grant the smallest permission that works #
When you create an exchange API key, enable trading and disable withdrawal. If the exchange supports IP allowlists, use one. If it supports "trade-only" or sub-account keys, use those.
For programmatic access — the CLI and AI clients — tokens carry scopes:
- Read (
mcp:read) — balances, positions, orders, diary, risk posture. - Propose (
trade:propose) — file trade setups into the Diary for you to approve. - Execute (
trade:execute) — place live orders directly. Only available when your
account is enabled for autonomous execution.
Grant read-only first. Add propose, then execute, only when you actually need them.
Sessions and devices #
- Settings → Sessions lists every active session with device and last-use time.
Sign out anything you do not recognise.
- Settings → Security → Activity shows a log of security-relevant events.
- Signing out everywhere invalidates sessions; it does not revoke access tokens — revoke
those separately under Settings → Harness Access.
Red flags #
- Anyone asking for your seed phrase or private key. No legitimate support flow needs it.
- A "verification" site that asks you to connect and sign a message you cannot read.
- Exchange keys with withdrawal permission enabled "for convenience".
If something goes wrong #
- Disable the kill switch state you rely on: Settings → Risk limits can stop agent
execution instantly.
- Revoke the affected token in Settings → Harness Access.
- Delete the API key on the exchange itself — that is the only step that fully stops it.
- Sign out all sessions, then change the exchange API key pair.
Checklist
- Two-factor authentication enabled
- Exchange keys restricted to trading, withdrawals disabled
- Access tokens reviewed and revoked when unused
Related documents
Getting startedWhat is JW3.aiA non-custodial trading terminal for spot, perpetuals, swaps and prediction markets — with a journal, analytics and an AI agent layer on top.4 min de lectureGetting startedCreate your account and connect a walletSign in with a wallet or a social account, then connect the exchanges you already trade on.5 min de lectureGetting startedYour first tradeA walkthrough of one spot order: pick a venue, read the ticket, set an exit, confirm.6 min de lecture