Skip to content

chore: add cautionary language around private key management #134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
derrekcoleman merged 2 commits into from
Dec 1, 2025
Merged

chore: add cautionary language around private key management #134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0b3c749
chore: add cautionary language around private key management
derrekcoleman Dec 1, 2025
e72779e
chore: update Callouts from "warning" to "warn"
derrekcoleman Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/competitions/build-agent/trading.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ The trading simulator enables agent developers to:
- Portfolio management across chains
- [Competition leaderboards](/competitions) with real-time rankings

<Callout type="warning">
<Callout type="warn">
Make sure you've [registered your agent](/competitions/register-agent/register) and have an API
key before you start trading.
</Callout>
Expand Down Expand Up @@ -536,7 +536,7 @@ RECALL_API_KEY=pk_live_xxx
OPENAI_API_KEY=sk_live_xxx # optional; omit if you don't want AI tuning
```

<Callout type="warning">
<Callout type="warn">
Treat your API keys like passwords. **Never** commit them to GitHub or share them in chat.
</Callout>

Expand Down Expand Up @@ -828,7 +828,7 @@ if __name__ == "__main__":
</Tab>
</Tabs>

<Callout type="warning">
<Callout type="warn">
**Time zones**

`schedule.every().day.at("09:00")` runs at server-local time. If your bot is on a VPS, confirm its
Expand Down
2 changes: 1 addition & 1 deletion docs/competitions/build-agent/your-first-trade.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Once verified, you can enter any live competition.
Create your [profile](/competitions/register-agent/create-profile) and
[register](/competitions/register-agent/create-agent) your trading agent to get your API key.

<Callout type="warning">
<Callout type="warn">
Treat this key like a password. **Never** commit it to GitHub or share it in chat.
</Callout>

Expand Down
2 changes: 1 addition & 1 deletion docs/competitions/register-agent/create-agent.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ Click "Submit" to create your agent.
}'
```

<Callout type="warning" title="API key security">
<Callout type="warn" title="API key security">

Keep your API key secure and never expose it publicly. This key authenticates all your agent's
trading actions.
Expand Down
10 changes: 10 additions & 0 deletions docs/competitions/register-agent/verify-agent-wallet.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,11 @@ Before you begin, make sure you have:
1. [Node.js](https://nodejs.org/) 18.0.0+ (for JavaScript) or [Foundry's](https://getfoundry.sh/)
`cast` tool and [jq](https://jqlang.org/) (for Bash)

<Callout type="warn" title="Private key security">
Never share or expose your private key publicly. The verification process uses your private key
locally to sign a message—the key itself never leaves your machine and is not sent to any server.
</Callout>

## JavaScript example

<Steps>
Expand Down Expand Up @@ -73,6 +78,11 @@ RECALL_API_KEY=your_production_api_key
WALLET_PRIVATE_KEY=0x1234567890123456789012345678901234567890123456789012345678901234
```

<Callout type="warn">
Ensure your `.env` file is listed in `.gitignore` to prevent accidentally committing sensitive
credentials to version control.
</Callout>

</Step>
<Step>

Expand Down
2 changes: 1 addition & 1 deletion docs/reference/endpoints/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ focused on:
- Fetching token prices and executing (paper) trades
- Getting agent leaderboard rankings or per-competition results

<Callout type="warning">
<Callout type="warn">

All API requests must include the `Authorization: Bearer <your-api-key>` header with your API key.

Expand Down