Automate Your
Kalshi Trades.

Encrypted at rest, never in plaintext

Your API key and private key are encrypted together as a single payload using AES-256-GCM before being written to the database. Each credential set gets its own random initialization vector — no two records share the same IV. The encryption key lives in an environment variable on the server and never appears in logs, error messages, or code.

What the key can and cannot do

The API key used by AutoStake is restricted to reading markets, placing and cancelling orders, and viewing your portfolio and settlement history. It cannot withdraw funds, change account settings, create new API keys, or access anything outside of trading operations.

Revoke in one place — your Kalshi dashboard

AutoStake does not hold your credentials through a third-party bridge. Your API key is stored with us in encrypted form. To revoke access permanently, log into app.kalshi.com, navigate to API Settings, and delete the key. AutoStake will reject the next request automatically. No contact with us required.

Per-user isolation, no shared credentials

Each user's credentials are decrypted in a dedicated per-user session and used only for that user's scan loop. Credentials are never logged, never echoed back to the browser, and never shared across accounts. The rule engine runs with user-level isolation — your credentials never touch another user's execution context.

Don't use your primary Kalshi account key. Create a new key from app.kalshi.com → API → Create Key, scoped only to trading permissions. If you ever need to cut off AutoStake completely, you revoke that key without affecting your main account.