Connect a Topstep-compatible account path to Botfolio

When this how-to matters

• You are past replay and considering live path connection
• You have API access questions and do not want to learn via a blown day
• You need a credential hygiene plan before tokens exist on your machine
• You want supervision and emergency controls verified before strategy live mode

Before you connect anything that can place orders

1. Read current TopstepX API access / eligibility pages
2. Read prohibited conduct & responsible trading guidance
3. Have your strategy replayed and risk rules written
4. Know your emergency control plan
5. Accept that day-one live is supervised, not “fire and forget”

Existing deep dives: Topstep API, TopstepX API key setup, Is automation allowed?.

Connection principles Botfolio markets

• Local desktop command center (not an opaque “trust us” black box)
• Production credentials intended for OS credential manager storage
• Supervised execution with visible status
• Lifecycle awareness around bots, positions, and protective orders

These are product-story anchors from the live site. Confirm the connect flow in your installed build; this guide does not prescribe a click-path.

High-level operator checklist

1. Obtain / enable TopstepX API access per official instructions
2. Authenticate using the product’s supported flow (confirm in-app)
3. Store secrets locally — never in screenshots, chats, or committed files
4. Verify connection state in the command center
5. Confirm you can stop / disconnect / flatten before enabling strategy live mode
6. Start with supervision, small size, and stand-downs armed
7. Keep support@getbotfolio.com handy for checkout/activation issues (separate from Topstep support)

What “compatible” does and does not mean

It means Botfolio is oriented to that funded-account automation workflow. It does not mean Botfolio is endorsed by Topstep, nor that every account tier automatically has API access.

If eligibility changes, official Topstep documentation wins. Always.

Credential handling deep dive

Treat tokens like account keys because functionally they are.

Do:

• prefer OS credential manager storage as Botfolio markets
• rotate on suspicion of exposure
• minimize who/what can read the secret

Do not:

• paste into Discord/Telegram “for debugging”
• commit to git
• leave plaintext .env files on the Desktop as a lifestyle

See credentials and local security.

Connection health and supervision

A connected bot is not necessarily a healthy bot. In the command center you want visibility into connection state, bot state, limits, and logs. If state is uncertain, stop new entries and inspect — especially around protective orders. See protective orders and emergency controls.

Hypothetical go-live sequence (educational)

1. Replay signed off
2. Risk controls configured
3. Official Topstep pages reviewed same week
4. Credentials stored properly
5. Connection verified while flat
6. Emergency drill completed
7. Strategy promoted with tiny/controlled size relative to budget
8. Human watches the first sessions

Skip steps and you are not accelerating — you are deleting brakes.

Common failure modes

1. Connecting before replay discipline exists
2. Assuming API access details from an old blog post
3. Storing secrets casually
4. Enabling live mode before flatten is practiced
5. Confusing Botfolio license activation with Topstep API auth
6. Ignoring official prohibited-conduct guidance because “it’s a bot”

What Botfolio does / does not do

Does

• Market a Topstep-compatible account and market data path
• Emphasize local credential posture and supervised execution
• Provide command-center visibility and emergency actions in the product story

Does not

• Grant Topstep API eligibility
• Replace official Topstep onboarding
• Guarantee fills, uptime, or trading outcomes
• Claim affiliation or endorsement

Separation of concerns: three different “keys”

Operators mix these up constantly:

1. Botfolio license — purchase/activation via getBotfolio.com checkout email after Stripe payment
2. Topstep / TopstepX API credentials — platform access governed by Topstep eligibility and docs
3. Machine OS login / disk encryption — local security posture that protects everything on the box

Different keys, different support desks, different failure modes. Botfolio support can help with license activation issues; it cannot invent Topstep API eligibility for you.

Pre-connection tabletop exercise

Sit down without the market open and answer:

• What official pages did I read in the last seven days?
• What is my flatten path if auth succeeds but state looks wrong?
• What is my action if auth fails mid-session?
• Who is supervising the first connected sessions?
• What size is allowed on first connected day regardless of replay enthusiasm?

Write the answers. If you cannot, you are not connecting late — you are connecting early.

After first successful connection (still flat)

1. Stare at connection state until it feels boringly clear
2. Confirm diagnostics are intelligible
3. Confirm stop/disconnect affordances
4. Confirm you did not leave secrets in a notepad
5. Only then discuss enabling a promoted strategy

Connection success is not strategy permission. It is plumbing readiness.

Compatibility mindset without overclaiming

“Topstep-compatible” in Botfolio’s marketing means the product is oriented to that funded-account automation workflow for market data, account state, and supervised orders. It is not a partnership badge. It is not a guarantee that your particular account state is eligible today. Official TopstepX API documentation remains authoritative for access.

If something in a third-party tutorial (including older Botfolio blog posts) conflicts with official docs, follow official docs.

Connection day runbook (flat only)

Morning prep

• Official pages open in a browser tab
• Rule sheet and risk settings already done
• Emergency drill already done earlier in the week
• License active / activation issues resolved via support if needed

Connection

• Perform supported auth flow in-app
• Confirm OS credential storage posture
• Confirm command-center connection state
• Confirm diagnostics are intelligible

Still flat validation

• Stop control understood
• Disconnect control understood
• Flatten policy written even though you are flat
• No strategy live mode yet

Only then

• Enable promoted strategy under supervision

Troubleshooting map (non-exhaustive, non-UI-specific)

When in doubt, keep risk flat and diagnose. Do not debug with live size.

Readiness scorecard before first live routing

Score each item 0 (missing), 1 (partial), 2 (solid):

1. Official Topstep API/eligibility docs read this week
2. Prohibited conduct / responsible trading pages acknowledged
3. Strategy evidence pack complete from replay
4. Risk contract written (fixed risk, stand-downs, window)
5. Credentials in OS credential manager posture
6. Command-center connection state understood while flat
7. Emergency controls drilled
8. Supervision calendar blocked
9. Demote criteria written
10. Support path known for Botfolio activation issues

If your total is under 16/20, keep routing off. The scorecard is intentionally strict. Prop automation punishes casual readiness.

Educational vignette: plumbing vs permission

An operator celebrates “connected!” and enables three strategies immediately. Connection was plumbing success. Permission was not earned. Within an hour, unclear protective-order state after a reconnect forces a messy flatten.

A slower operator treats first connection as a flat-only milestone, then enables one promoted strategy the next supervised session. They can still lose. They are less likely to stack first-day failures.

Neither vignette is a performance claim. It is sequencing advice.

Quick takeaways

• Eligibility is defined by Topstep and can change.
• Botfolio’s marketed approach: OS credential manager / local secret storage — not plaintext project files.
• Prefer workflows with reconnect + diagnostics visible, and a practiced flatten path.
• No. support@getbotfolio.com is listed for Botfolio checkout/activation issues. Platform account issues belong with the platform.