Read time … min

AI-native runtime for Bybit trading strategies

Author in Cursor, Claude Code or any AI IDE. Deploy from GitHub into a managed cloud runtime with first-class MCP control, logs and region selection.

By the TradingHost engineering team

Section 01 · At a glance

At a glance

Venue
Bybit
Venue type
Crypto exchange (derivatives-led)
Asset class
Crypto (spot, linear and inverse perpetuals, USDC futures, options, spread)
Supported products
Spot, USDT perpetuals, USDC perpetuals, USDT futures, USDC futures, inverse perpetuals, inverse futures, European-style USDC options, spread trading, copy strategies, demo trading. Available via UTA 2.0 (default for accounts registered 2025+); UTA 1.0 still in service for legacy users. Classic accounts no longer offered.
Runtime model
Containerised strategy runtime
Deployment source
GitHub
Languages
Any language that runs in a container
Common integrations
Native Bybit v5 REST and WebSocket, CCXT, Freqtrade, Hummingbot, custom
AI workflow integration
MCP control surface for Cursor, Claude Code, GitHub Copilot and CLI agents
TradingHost role
Runtime, deployment, logs, health checks, region selection, MCP control
Bybit role
Exchange account, API access, market access, execution venue
Affiliation
TradingHost is independent and is not affiliated with Bybit

Section 02 · What Bybit offers

What Bybit offers

Bybit's v5 API unifies spot, linear and inverse perpetuals, USDT and USDC futures, and European-style USDC options behind a single `category` parameter, with Spread Trading and Demo Trading as additional surfaces. Under UTA 2.0, every category shares one cross-product margin pool. Strategies authenticate with HMAC-SHA256 (system-issued) or RSA-SHA256 (self-issued) keys and reach the venue over REST or WebSocket. Mainnet, testnet and mainnet demo are three distinct environments with disjoint key namespaces. Endpoint specifics change over time. The shape is durable; the precise rate-limit budgets, fee tiers and symbol lists live in Bybit's docs.

Markets and strategy patterns

  • USDT perpetual market making
  • USDC perpetual basis and carry
  • Inverse perpetual coin-margined hedging
  • Options gamma scalping (USDC-settled, Portfolio Margin)
  • Funding-rate arbitrage via Spread Trading order book
  • Copy strategies via Master Trader automation
  • UTA 2.0 cross-product portfolio margin strategies
  • Demo-trading dry-runs before mainnet deploy

API surface

Product surfaces
Unified v5 categories (`spot`, `linear`, `inverse`, `option`), plus Spread Trading and Demo Trading endpoints. UTA 2.0 unifies all categories under one margin pool. Mainnet, testnet (api-testnet.bybit.com), and mainnet demo (api-demo.bybit.com) are three distinct environments with disjoint key namespaces.
Connection methods
REST v5 (HTTPS), WebSocket public (market data), WebSocket private (order, exec, position, wallet), WebSocket trade (order entry over WS, mainnet only).
Authentication
HMAC-SHA256 (system-issued keys) or RSA-SHA256 (self-issued keys). Required headers: `X-BAPI-API-KEY`, `X-BAPI-TIMESTAMP`, `X-BAPI-SIGN`, `X-BAPI-RECV-WINDOW` (default 5000 ms). Sub-account hierarchy and per-key IP whitelisting supported. API access from US or Mainland China IPs returns HTTP 403.

For specifics, refer to Bybit

Specific endpoints, rate-limit budgets, symbol lists, fee tiers and version history live in Bybit's documentation. Treat these as the source of truth.

Section 03 · Build with AI

Build your Bybit strategy with AI

Pick an integration method, fork a TradingHost framework starter, and author your strategy in an AI IDE. Cursor, Claude Code, GitHub Copilot and CLI-based AI agents all work with the same GitHub-native deployment loop. Bybit's v5 category-based product surface and UTA 2.0 cross-product margin mean one strategy can reach spot, perpetuals, futures and options through a single unified account.

  • Native Bybit API

    Direct control over Bybit-specific behaviour, account data and order execution logic via the v5 unified API.

  • CCXT

    Common interface across Bybit and other crypto exchanges.

  • Freqtrade or Hummingbot

    Framework-based deployments using their strategy structure and configuration model.

  • Custom connector

    Your own internal trading engine or proprietary Bybit integration.

Framework support for Bybit products

Coverage varies by framework. CCXT and native v5 span the full Bybit surface; Freqtrade covers spot and linear perpetuals (one subaccount per bot recommended); Hummingbot covers spot and perpetuals with partial inverse support (one mode at a time).

FrameworkSpotPerpInverseOptions
Native Bybit v5SupportedSupportedSupportedSupported
CCXTSupportedSupportedSupportedSupported
FreqtradeSupportedSupportedNot documented as supportedNot documented as supported
HummingbotSupportedSupportedPartially supportedNot documented as supported

✓ confirmed support per official framework docs. "partial" indicates documented but limited (e.g. one mode at a time). "no" indicates not officially documented as supported.

TradingHost does not force a framework. It runs your project.

Author with AI

The framework starters above pair naturally with AI IDEs. The TradingHost MCP control surface closes the loop: AI tools can inspect deployments, review logs and manage the runtime alongside you, never the trade execution path.

Section 04 · Run on TradingHost

Run your code on TradingHost

Bybit provides the exchange and API access. TradingHost provides the production environment where your Bybit-connected strategy runs.

Instead of running strategy code on a laptop, desktop machine, generic VPS or manually configured server, you deploy from GitHub into a TradingHost-managed container runtime.

You

  • Your repo contains your code.
  • Your deployment defines how it runs.
  • Your strategy connects to Bybit.

TradingHost

  • Keeps the runtime online.
  • Surfaces logs and health checks.
  • Region selection.
  • Controlled deployment surface.

Deployment flow

  1. STEP 01

    Connect GitHub

    Authorise TradingHost to access your GitHub account.

  2. STEP 02

    Link a repo or start from a framework

    Point TradingHost at your existing strategy repo, or fork a TradingHost framework runtime (CCXT, Freqtrade or Hummingbot) for a working baseline.

  3. STEP 03

    Deploy into a TradingHost container

    Pick a region (EU or US-East), supply the environment values your strategy needs (Bybit API keys, etc.), and deploy. TradingHost builds your container from the repo and runs your strategy on managed Kubernetes infrastructure. No local Docker install required.

  4. STEP 04

    Monitor logs and health

    Watch live logs, health and runtime state from the TradingHost dashboard. The same surface is reachable through MCP from any AI IDE, so Cursor, Claude Code or a CLI agent can read deployment state and manage the runtime alongside you.

  5. STEP 05

    Update and redeploy

    Push changes to your GitHub main branch and TradingHost redeploys automatically.

Section 05 · Operational notes

Operational notes for Bybit

Things that bite you when you actually run a Bybit strategy in a containerised cloud runtime, not in Bybit's docs, not in framework READMEs. Every claim below is quoted or paraphrased from Bybit's own documentation; the deployment-side guidance is from running these strategies on TradingHost.

  1. 01 · v5 unification

    v5 API unifies categories; v3 retired August 2024

    Bybit's v5 API unifies spot, linear perp, inverse perp and options behind a single `category` parameter. The official v3-to-v5 transition retired v3 endpoints on August 31, 2024. Run all new code against v5; v3 returns errors.

  2. 02 · Environments

    Mainnet, testnet and mainnet demo are three different hosts

    Mainnet uses api.bybit.com and stream.bybit.com. Testnet uses api-testnet.bybit.com and stream-testnet.bybit.com. Mainnet demo uses api-demo.bybit.com and wss://stream-demo.bybit.com for private streams (public market data still from mainnet). Keys are not shared across environments; a demo key against testnet host returns error 10003. WS Trade (order entry over WebSocket) is not available on demo.

  3. 03 · Account mode

    UTA 2.0 vs UTA 1.0 vs legacy Classic

    Three account modes have existed: Classic (no longer offered), UTA 1.0 (unified spot and USDT/USDC derivatives and options; inverse still separate), and UTA 2.0 (every category sharing one margin pool with cross or portfolio margin). Accounts registered in 2025 or later are UTA 2.0 by default. Upgrade to UTA is irreversible; in UTA 2.0 inverse futures no longer support hedge mode.

  4. 04 · Rate limits

    Per-UID per-category rolling window

    v5 limits are per-UID rolling-window and partition by category. Order create is 20/s for spot and linear, 10/s for inverse and option; amend is 10/s across all four; cancel mirrors create. IP-level cap is 600 HTTP requests per 5-second window. Batch endpoints consume per order, not per request, with caps of 10 (spot) and 20 (linear / inverse / option) per batch. Response headers expose remaining budget.

  5. 05 · Security history

    February 2025 Lazarus incident, what changed

    On February 21, 2025, attackers tied to North Korea's Lazarus Group (TraderTraitor) stole approximately $1.5B in ETH from a Bybit cold wallet by compromising a developer workstation at third-party multisig provider Safe{Wallet} and tampering with the signer UI. The FBI confirmed attribution in IC3 PSA-250226. Bybit remained operational: withdrawals continued, the Hacken Proof of Reserves audit confirmed reserves above 100% across BTC, ETH, SOL, USDT and USDC, and Bybit publicly stated user funds were unaffected. Bybit subsequently isolated signing infrastructure, redesigned multisig flows, audited third-party tooling, added anomaly detection on transfers, and continues monthly Merkle-tree PoR with Hacken. For API users this is historical context: posture changed, surface area did not.

  6. 06 · Region restrictions

    US and Mainland China blocked at the API edge

    The v5 guide states explicitly that IP addresses located in the US or Mainland China return a 403 Forbidden error. Regional hostnames exist for Netherlands, Turkey, Kazakhstan, Georgia, UAE, EEA, and Indonesia. KYC is mandatory and a US-resident identity is blocked at verification even if the IP passes. TradingHost runtime region selection should avoid US regions when targeting Bybit.

  7. 07 · Common errors

    Auth and rate-limit codes to instrument

    10003 invalid api_key usually means wrong environment (mainnet key hitting testnet host or demo key hitting mainnet). 10004 invalid sign means clock drift beyond `recv_window`, or signature payload assembled in the wrong order. 10018 exceed IP rate limit signals the 600 req / 5 s cap; back off using `X-Bapi-Limit-Reset-Timestamp`. Treat 10003 and 10004 as alert-and-halt, not retry.

  8. 08 · Spread Trading

    Spread Trading is a separate order book

    Spread Trading supports Spot/Perp, Spot/Expiry, Perp/Expiry and Expiry/Expiry combos on BTC, ETH, SOL with its own order book and 50% lower fees vs legging in manually. Listed as a feature surface in the v5 docs rather than a documented `category`; route via the help-center endpoint references when wiring.

Section 06 · Built for

Built for

TradingHost Bybit runtimes are best suited to:

  • Developers building strategies in AI IDEs (Cursor, Claude Code)
  • Systematic crypto traders
  • Quant developers
  • CCXT, Freqtrade and Hummingbot users
  • Teams moving from VPS hosting to containerised deployment

Connecting GitHub and creating your first strategy is free.

Section 08 · FAQ

FAQ

No. TradingHost is independent and is not affiliated with Bybit.

No. Your strategy code connects to Bybit and sends instructions according to your own logic, account permissions and integration method. TradingHost provides the runtime where that code runs.

No. Bybit API access is provided by Bybit. You are responsible for your Bybit account, API permissions, credentials and compliance with Bybit’s terms.

No. TradingHost is the cloud runtime where your strategy code runs. We do not provide signals, AI prediction models or pre-built strategies. With TradingHost you write or generate the strategy yourself (often with Cursor or Claude Code), keep it in GitHub as your code, and use TradingHost to run it in production. 3Commas, Cryptohopper and similar products own the strategy logic; TradingHost runs your strategy.

AWS and DigitalOcean give you raw compute. You handle OS updates, container orchestration, log shipping, secret rotation, region failover and uptime monitoring yourself. TradingHost gives you a managed runtime purpose-built for trading strategies: GitHub-native deployment, MCP-driven control from AI IDEs, log and health surfaces out of the box. If you want to operate the infrastructure yourself, AWS works. If you want the runtime as a managed service, TradingHost is the shorter path.

Yes. TradingHost runs Python strategies; pick the framework runtime that matches your stack or deploy your own repo.

Yes. TradingHost supports any language that can run inside a container.

Yes. CCXT's bybit exchange covers spot, linear and inverse perpetuals, USDT and USDC futures, and USDC options against v5. Deploy your CCXT strategy from GitHub into a TradingHost runtime; we run it, you keep your keys. See the CCXT framework runtime for the full setup story.

Yes, if your project is designed that way. You can run multiple strategy processes or services inside one runtime, or separate them into different runtimes for isolation and operational clarity. See the TradingHost runtime page for the multi-strategy model.

The fastest path is to fork a TradingHost framework runtime: CCXT, Freqtrade or Hummingbot for a ready-to-deploy project. Or connect your own GitHub strategy repo. Linking a GitHub repo and creating a strategy is free; runtime plans are listed on the pricing page.

In your GitHub-controlled secrets workflow. TradingHost reads them at runtime through GitHub repository secrets, environment secrets or your own approved secret-management process. TradingHost does not need custody of your API key and secret. See platform secrets for the full handling model.

No. Strategies should never need withdrawal permissions. Use scoped permissions and per-key IP whitelisting where appropriate, and keep withdrawal scope on a separate manually-managed key.

Yes. TradingHost supports MCP-based control for AI IDEs including Cursor, Claude Code, GitHub Copilot and CLI-based AI agents. AI tools can inspect deployments, review logs, restart strategies and manage runtime workflows. MCP is a control and observability surface, not the trade execution path. See the MCP control surface for the full picture.

Both. The MCP control surface works equally well from CLI-based agents (Claude Code CLI, custom MCP clients, scripted MCP calls) and from inside an IDE. The GitHub-native deployment loop also works without any AI tooling: a regular git push to your main branch triggers a redeploy.

The runtime detects the crash and exposes the relevant logs and health information. Where supported, the affected strategy can be restarted without disrupting other strategies running in the same container. Your strategy code is still responsible for safe error handling, duplicate-order protection and risk controls. See observability for the logs and health surface.

Three causes account for nearly all 10004 errors: request timestamp outside the recv_window window (default 5000 ms) due to clock drift, signature payload assembled with parameters in the wrong order, or accidentally using HMAC payload format with an RSA key (or vice versa). Sync your runtime clock or fetch Bybit server time before signing. See the Operational notes section above for the full guidance.

Bybit runs three environments with disjoint key namespaces: mainnet, testnet (api-testnet.bybit.com), and mainnet demo (api-demo.bybit.com). A key issued in any one returns 10003 on the other two. Generate a fresh key from the matching dashboard.

Accounts opened 2025 or later default to UTA 2.0. If you’re on Classic or UTA 1.0 and want cross-product margin, upgrade. The upgrade is irreversible and inverse futures lose hedge mode. Test against demo first.

No. Bybit blocks US and Mainland China IPs at the API edge with a 403 response, and KYC rejects US-resident identities. TradingHost cannot route around this; the restriction is set by Bybit.

The incident was real, large, and well-documented (FBI IC3 PSA-250226). Bybit's hot operations, withdrawals, and customer balances were unaffected; the Hacken Proof of Reserves audit dated February 26 confirmed reserves over 100% across major assets. Bybit has since isolated signing infrastructure, redesigned multisig flows, and continues monthly Merkle-tree PoR. For an algorithmic strategy user this is operational context, not a current API blocker, but treat exchange custody risk as real and size accordingly.

TradingHost runs in the EU and US-East regions. Pick the region closest to the matching engine your strategy depends on. Note that Bybit blocks US IPs at the API edge, so Bybit strategies should not route from the US-East region. See the regions page for routing and proximity details.

No. TradingHost is focused on production runtime and deployment. Backtesting belongs in your research stack, framework or AlgoBuilder.