Botfolio credentials and local security

When this how-to matters

• Before first API connection
• After any suspected secret exposure
• When switching machines
• When you used plaintext “just for testing” and need to clean up

Non-negotiables

• Do not commit secrets to git
• Do not paste tokens into chats, tickets, or screenshots
• Do not email keys to yourself “for later”
• Rotate credentials if exposure is suspected
• Prefer least privilege where the platform allows
• Separate Botfolio license keys from trading API secrets mentally and in storage practice

Why local credential posture matters for Topstep workflows

Cloud convenience often means someone else’s disk holds the keys. Botfolio positions local secret storage as part of a supervised desktop design. See local vs cloud and API key setup.

Local is not automatically secure if your disk is unlocked, shared, or littered with plaintext notes. OS credential manager helps; operator discipline finishes the job.

Operator checklist

1. Enable API access via official TopstepX process
2. Authenticate through Botfolio’s supported flow (confirm in-app)
3. Confirm secrets landed in OS credential storage (not a random .env on the desktop)
4. Verify connection in the command center
5. Test disconnect without losing track of open risk procedures
6. Remove leftover plaintext test secrets
7. Document rotation date if exposure happened

License keys vs trading credentials

Purchase flow delivers a license via checkout email after Stripe payment ($299 launch license on the live purchase card as researched). That is separate from Topstep/API trading credentials. Do not conflate them. Support for checkout/activation: support@getbotfolio.com.

Machine hygiene that supports credential safety

• Prefer a machine you control
• Keep OS updates intentional around trading hours (don’t surprise-reboot mid-session)
• Be careful with screen shares that might reveal secret UI
• Avoid “helpful” debugging by pasting tokens into group chats
• Consider full-disk encryption as baseline device hygiene (general security practice; not a Botfolio-specific feature claim)

Hypothetical exposure response (educational)

You pasted a token into a ticket by accident.

1. Assume compromise
2. Revoke/rotate via official platform process
3. Remove copies from ticket/email/notes
4. Re-auth using proper storage
5. Review whether any unexpected trading activity occurred
6. Write down how to prevent recurrence

Speed matters more than embarrassment.

Common failure modes

1. Plaintext lifestyle
2. Shared family computer casualness
3. Screenshot debugging
4. Old tokens left valid after tests
5. Confusing “local” with “secure by default”

What Botfolio does / does not claim

Does

• Intend production credentials for OS credential manager storage
• Market local desktop credential handling vs casual plaintext secrets
• Support macOS/Windows product posture in schema

Does not

• Claim that getBotfolio.com stores your Topstep password on a server. The marketed design is local credential handling, not a server-side password vault
• Make you immune to phishing or malware
• Replace Topstep’s own credential/security requirements

Threat model lite (practical, not paranoia theater)

You do not need a security team cosplay. You do need to know what you are defending against:

• Accidental plaintext leakage (most common)
• Shared-machine curiosity
• Chat/screenshot leakage
• Stolen laptop with unlocked secrets
• Old tokens that should have been rotated

Controls that help: OS credential manager usage (as Botfolio markets), rotation habits, fewer secret copies, careful screen sharing, device lock discipline.

Onboarding a new machine

1. Install Botfolio per your licensed process
2. Do not copy old plaintext secret files “to save time”
3. Re-auth cleanly into OS credential storage
4. Verify connection while flat
5. Re-run emergency drill once on the new machine
6. Only then consider live risk

New machine day is a high-mistake day. Keep it flat longer than your ego wants.

Secrets and journaling

Trade journals are good. Pasting tokens into journals is not. If you need to note auth issues, describe symptoms, not secret values.

Credential lifecycle calendar

• Issue/obtain: via official Topstep process when eligible
• Store: OS credential manager posture as Botfolio markets
• Use: only through supported product auth flows
• Review: monthly “where do secrets live?” audit
• Rotate: on exposure, machine loss, shared-access suspicion, or platform guidance
• Retire: revoke old tokens; delete plaintext leftovers

Put a recurring calendar reminder. Security that relies on memory fails on busy weeks.

Shared household / shared office caution

If anyone else can unlock your trading machine, your threat model includes curiosity and accidents. Local credentials are still local to a machine others might access. Device lock + account separation matter.

What to tell future-you in a sticky note

“Tokens are not notes. Notes are not tokens. License email ≠ API key. If unsure, rotate and keep flat.”

Credential anti-patterns borrowed from normal software bad habits

• “Temporary” plaintext files that become permanent
• Reusing the same secret across test and production contexts longer than intended
• Putting secrets in cloud sync folders that proliferate copies
• Debugging with screenshots that include partial tokens
• Assuming a deleted chat message means the secret was never retained elsewhere

Replace each anti-pattern with a written habit. Botfolio’s credential-manager posture helps most when these habits are real.

Coordination with privacy/terms mindset

The site’s privacy and terms pages discuss license/purchase data handling at the business layer. That is adjacent to, not identical with, trading API secret handling on your desktop. Read /privacy/ for site/purchase data expectations, and keep trading secrets local per product marketing.

Extended operator notes for botfolio credentials and local security

This section exists to make the page operationally complete enough for evergreen SEO depth without inventing product UI fiction. Use it as a working appendix.

Pre-commit questions

Before you claim this part of the Botfolio workflow is “handled,” answer:

1. What artifacts prove it (notes, drill logs, evidence packs)?
2. What would a skeptical co-pilot say is still fuzzy?
3. What official Topstep constraint could invalidate today’s plan?
4. What Botfolio control will you use if live state disagrees with the plan?
5. What demote/abort condition is written down?

Failure rehearsal

Write a short paragraph describing how this area fails in the wild (not how it succeeds). Then write the containment step that uses supervised controls rather than hope. If you cannot describe failure, you have not finished design.

Weekly maintenance

Revisit this topic weekly for the first month of live use, then monthly. Tools drift, emotions drift, and stage rules can change. Evergreen process only stays evergreen if someone maintains it.

Boundary with claims

Nothing in this appendix promises profits, payouts, Combine passes, or risk-free trading. It is process depth around verified Botfolio themes: replay, promote, supervise, local credentials, risk limits, and emergency actions. Confirm in-app details for your version whenever this appendix meets the real UI.

Final sanity checks before live tokens touch live risk

• Secret storage location verified today, not “I think so”
• No plaintext leftovers in Downloads/Desktop/Notes
• License email inbox secured separately from API secrets
• Rotation plan known if the laptop goes missing this afternoon
• Flat verification completed after any credential change

Keep this guide nearby during early supervised sessions so process beats improvisation.

Quick takeaways

• Trading credentials stay in the operating system’s credential storage on your machine.
• Move to proper storage, rotate the exposed credential, and delete old copies.
• Protect the inbox used for license delivery; it is part of your software access chain.
• When you used plaintext “just for testing” and need to clean up.