The gateway — riskmanaged.io docs

Run the open-source gateway on your own hardware so your exchange API keys never reach the platform — the self-custody alternative to Direct connection.

The gateway solves one problem: keeping your exchange API keys off the platform's servers. It is an open-source program you run on your own machine (a laptop, a home server, a VPS). Your keys live there and nowhere else — the platform sends it trade instructions, the gateway executes them locally against your exchange, and returns the result.

If you connect an exchange Directly, the platform stores your key (encrypted) and trades for you — simplest, and fine for most people. The gateway is for when key custody is a hard requirement.

How self-custody works#

The platform never sees your key. It sends trade instructions over an authenticated WebSocket; your gateway holds the key, executes the order on your exchange, and sends the fill back. Everything right of the dashed line runs on hardware you control.

Direct vs the gateway#

	Direct	Gateway
Setup	Enter API keys in the UI — done	Install the gateway on your machine or VPS
Where the key lives	Encrypted on the platform's servers	On your machine only
Self-custody	No — the key is entrusted to the platform	Yes — the key never leaves your hardware
Latency	Lower (server → exchange)	Slightly higher (signal → gateway → exchange)
Open source	—	Yes — on GitHub
Exchanges	All supported	All supported

Installing the remote gateway#

# 1. Install
curl -sSL https://riskmanaged.io/gateway/install.sh | bash

# 2. Authorize — opens this site in your browser, no token to copy
riskmanaged-gateway login

# 3. Add an exchange (your keys are verified before they are saved)
riskmanaged-gateway add-exchange

# 4. Start it
riskmanaged-gateway

Or install from source:

git clone https://github.com/riskmanaged/riskmanaged-gateway.git
cd riskmanaged-gateway
pip install -e .
riskmanaged-gateway bootstrap

Gateway commands#

Command	Description
`riskmanaged-gateway`	Start the gateway
`riskmanaged-gateway login`	Authorize via the browser and store an API token
`riskmanaged-gateway bootstrap`	Guided first-time setup
`riskmanaged-gateway add-exchange`	Add an exchange with API keys
`riskmanaged-gateway list-exchanges`	Show configured exchanges
`riskmanaged-gateway remove-exchange <label>`	Remove an exchange
`riskmanaged-gateway test [label]`	Re-check your credentials against the exchange
`riskmanaged-gateway status`	Show local configuration

Headless and Docker#

Every setting can come from the environment, so the gateway can be provisioned without prompts. Containers have no browser, so use a token from your profile page instead of login.

export RISKMANAGED_API_KEY=your-token
riskmanaged-gateway bootstrap --yes
riskmanaged-gateway add-exchange --exchange binance --label binance-main \
  --api-key "$KEY" --api-secret "$SECRET"

# Or with Docker
echo "RISKMANAGED_API_KEY=your-token" > .env
docker compose up -d

Where your keys are stored#

Exchange secrets go into your operating system's keyring when one is available, falling back to 0600 files under ~/.riskmanaged/exchanges/ on headless servers and in containers. riskmanaged-gateway status shows which is in use. The gateway will only ever execute nine CCXT methods on your behalf — trading, balance and leverage. No withdrawal or transfer method is permitted, so the platform cannot move your funds.

Running as a service#

For 24/7 operation, install the gateway as a systemd service (offered during bootstrap):

# Enable and start
systemctl --user enable --now riskmanaged-gateway

# Check status
systemctl --user status riskmanaged-gateway

# View logs
journalctl --user -u riskmanaged-gateway -f

TIP

Multi-exchange support: A single gateway instance can manage multiple exchanges simultaneously. Each exchange is configured as a separate YAML file in ~/.riskmanaged/exchanges/.