The Prow Bots key

Your bots run on Prow's servers, so they need a key that lives there. That key is called Prow Bots. It is separate from the trading key on your device, which never leaves your browser. See How trading keys work.

What it can and cannot do

Prow's servers also refuse any bot order outside the limits you signed for that bot, and never move funds with a bot key. Those are Prow's checks, not the venue's: if Prow's servers were compromised, the key itself could place other orders, and on Aster also move funds between your own spot and futures. It can never move them out of your account.

There is one Prow Bots key per venue account. All bots on that account share it. On Aster it is named Prow-Bots.

How it is made and stored

1. Prow's servers create the key

   When you start your first bot on an account, Prow's bot service creates a new key. The private key never leaves that service: not to Prow's website, not to its database in readable form, not to its logs.

2. It is encrypted before it is stored

   Each key is encrypted with its own random key, which is encrypted again with a master key kept on the bot servers only. The stored copy is bound to your account and the key's address, so it can't be moved to another user.

3. Your wallet approves it

   The start review lists Enable bots on Hyperliquid (or Aster) under Before it starts, and What the bot key can do opens under it. Your main wallet signs once to approve the key on the venue. No network fee, no funds move. Prow checks that the key's address was really created by its bot service before it asks you to sign.

4. Prow checks the venue

   Before the first order, and regularly after, the bot service reads the venue's list of approved keys and checks that the approved Prow Bots address is the key it holds, with withdrawals off. If not, it pauses the bots and tells you.

On Aster, Prow approves the key with withdraw off and locked to Prow's two server IP addresses. The key doesn't work from anywhere else, even if someone copied it. Spot trading stays off on the key unless you start an Aster spot bot, which isn't offered.

On Hyperliquid, the key is an API wallet, like your device keys. Hyperliquid allows 3 named API wallets per account. Prow Bots takes one slot, shared by all bots on the account. If all 3 are used, remove one you no longer need on app.hyperliquid.xyz/API first.

The limits you sign

Before each bot starts, your wallet signs its limits. Your wallet shows them:

• the market and whether it is spot or futures,
• the largest investment and the largest single order,
• the highest leverage,
• the max loss,
• where the stop loss may sit,
• the price range the bot may trade in,
• the highest Prow fee,
• an end date, at most 30 days away.

Prow's servers check every order against these limits before they sign it and refuse the rest. Because your wallet signed them, nobody can widen them without a new signature from you, not even someone who changed Prow's database. They don't bind the key on the venue: someone who took over Prow's servers would hold the key itself. Each signature works for one start only, so a stopped bot can't be restarted with an old one.

You sign again when you resume a bot that Prow paused, and to keep a bot running past its end date: from 3 days before, the bot's page shows Renew limits (one signature, same settings). Without it the bot pauses an hour before the end date, with its stop kept; resuming then asks for the signature.

Delayed start

If you approved the key less than an hour ago, a new bot shows Scheduled and starts 15 minutes later. You get a notice. If you didn't start it, tap Cancel start. This gives you time to react if someone else got into your Prow account.

Renew every 30 days

The key expires after 30 days. Prow can't remove a Hyperliquid key for you, so a short life is what limits the damage of a stolen key.

From 7 days before, the Bots page says "Your Hyperliquid bot key expires in 6 days (keys expire for safety)", and you get a notice. Press Renew (1 signature) and sign once. Your bots switch to the new key on their own, with no gap.

If you don't renew, an hour before expiry each bot cancels its buy and sell orders and pauses. Its stop stays on the venue as your normal order. After expiry the bots can't do anything, including cancel.

Remove the key

Stop your bots first, then remove the key on the venue.

1. Stop your bots

   Open Bots and press Stop all, or stop each bot and choose what happens to its position. Wait until they show in History.

2. Open the venue's API page

   Hyperliquid: app.hyperliquid.xyz/API. Aster: the API wallet page on asterdex.com. Connect the wallet that owns the account.

3. Remove Prow Bots

   Remove the key named Prow Bots (Hyperliquid) or Prow-Bots (Aster). Your wallet signs once.

If something goes wrong at Prow

• Prow's servers go down: orders already on the venue stay, including each bot's stop loss. Bots catch up when the servers are back.
• Prow halts bots: Prow can switch every bot to close-only at once. Stops stay on, and nothing new opens.
• Prow's servers are compromised: an attacker still can't withdraw or send funds to another account, but could trade with the key, including outside the limits you signed (those are checked by Prow's servers), until it is removed or expires. On Aster the key could also move funds between your own spot and futures balances (for example to add margin to a losing futures position), never out of your account; Prow's servers block that in normal running. On Aster, Prow can switch off its server IP addresses, and every Prow Bots key stops working at once. On Hyperliquid only your wallet can remove the key. Prow would ask you to remove it at once, and keys expire within 30 days anyway.