Protecting Your Account
Bankr has two layers of safety controls: wallet-level (applies to every surface) and per-API-key (applies to one key). Both run independently — a transaction must satisfy both to broadcast. If something looks wrong right now, jump to Incident Response below.
Wallet-Level Controls
Configure at bankr.bot → Security:
Control | Default | What it does |
|---|---|---|
Pause all transactions | Off | Blocks every outbound transaction until unpaused |
Daily spending limit | $500/24h | Rejects any tx that pushes rolling 24h outflow past the limit |
Per-transaction limit | $500 | Rejects any single tx above the limit |
Permitted recipients | Off | Restricts transfers to an allowlist with cooldown period |
Disable arbitrary contract calls | Off | Blocks raw contract calls (named operations like swaps still work) |
Sessions & Devices
Every sign-in shows up under bankr.bot → Security → Active Sessions, with the device and location and a per-row revoke. Revoking logs that device out immediately — use it on anything you don't recognise.
CLI logins are tracked and revocable too, but only from an up-to-date CLI. If a bankr login session is missing from the list, update with bun install -g @bankr/cli and sign in again so the session can be recorded.
API Key Controls
Configure at bankr.bot/api-keys:
Read-only mode — strips all write tools from agent sessions
IP allowlist — restricts which IPs can use the key
Recipient allowlist — restricts which addresses the key can send to
Use a Dedicated Agent Wallet
For production agents, use a separate Bankr account with its own API key and wallet. This isolates your personal funds, enables independent controls, and makes key rotation easy.
Incident Response
If you suspect a key or device is compromised:
Pause the wallet at bankr.bot → Security (halts all transactions immediately)
Revoke the key at bankr.bot/api-keys, and any unrecognised session under Security → Active Sessions
Rotate — generate a new key with the same profile
Audit — review recent transactions before unpausing
Remember: Bankr support will never ask for your seed phrase, private keys, or passwords, and will never DM you first. Anyone doing that is a scammer — see How Support Works.
For full details, see Security Best Practices on docs.bankr.bot.