Crypto trading-bot wallet security: signing and secrets
Dexfy’s current account-authentication, Privy wallet-signing, MFA, secret-storage, export, and dedicated-wallet security model.
Direct answer
Dexfy uses Supabase for account authentication and MFA and Privy for wallet signing material and policy-controlled remote signing. Dexfy stores wallet addresses and Privy identifiers rather than plaintext private keys in its application database. Because automation can sign without an open browser session, users should treat Dexfy wallets as dedicated trading wallets and keep balances scoped to the strategy.
Questions answered
- How should a crypto trading bot handle wallet signing?
- Does Dexfy request seed phrases or private keys?
- What wallet permissions should automation receive?
Two different security responsibilities
Account access and wallet signing are related but separate. Supabase controls Dexfy sign-in, sessions, password flows, and authenticator-app MFA. Privy manages signing material and the remote signing controls used by configured manual and automated workflows.
The application database stores the wallet address and provider identifiers needed to reference a wallet; it does not store a plaintext private key. Plaintext wallet secrets are also not placed in Fly runtime configuration.
What automation changes
An automated strategy cannot depend on an open browser confirmation for every transaction. Dexfy therefore uses server-authorized, environment-specific signing policies for configured workflows. This differs from a non-custodial browser wallet that asks the user to approve each signature locally.
Use dedicated wallets, limit balances to the active strategy, separate long-term holdings, enable MFA, and review sessions and execution history.
Secrets Dexfy will never request in support
- Private keys or seed phrases.
- Passwords or authentication tokens.
- MFA or recovery codes.
- Screenshots of secret-reveal dialogs.
Export is a boundary change
Exporting a private key is a distinct owner-authorized action that requires a fresh account session and can require MFA step-up. Once exported, the plaintext secret is outside the protected flow and must be handled as fully sensitive.
Sources and evidence
Sources support the product facts and protocol mechanics above. They do not convert risk observations into guarantees.
- Dexfy: Wallet security and secrets
Current Dexfy signing, custody, export, and operating model.
- Dexfy: Sessions and MFA
Current account-level MFA and session controls.
- Privy: Wallet infrastructure security
Provider documentation for Privy wallet infrastructure.
- Supabase: Auth architecture
Provider documentation for Supabase Auth.
Continue learning
Check the workflow in Dexfy
Verify current chain, route, quote, liquidity, and protection availability in the live product before funding or enabling automation.