What you will accomplish
- Build and run the official bot
- Protect Telegram and exchange credentials
- Use paper mode and private-chat onboarding
- Understand confirmation and local-trigger behavior
Before you begin
- Node.js and npm
- A Telegram bot token from BotFather
- A server with encrypted storage and process monitoring
- A Quote.Trade key only after paper-mode testing
The current CLI and Telegram repositories may default DEFAULT_PAYMENT_CURRENCY to USD, while the authenticated order reference treats paymentCurrency as a separate field and illustrates stablecoins such as USDT. Before enabling real mode, use the value accepted by the current account and order schema. Do not infer the funding asset from quoteAsset=USD.
Clone and review the official repository
Use the Quote.Trade GitHub organization. Review the README, sample configuration, dependency lockfile, and current security behavior before deployment.
git clone https://github.com/quoteTrade/quote-trade-telegram-trading-bot.git
cd quote-trade-telegram-trading-bot
cp sample.env .env
npm install
npm run build
npm testA successful build and test run exits without errors.
Configure endpoints and paper mode
Set the Telegram token through a secret manager. Use the official Quote.Trade production bases and MODE=paper. Generate a strong TELEGRAM_SESSION_ENCRYPTION_KEY and never commit .env.
TELEGRAM_BOT_TOKEN=<secret-manager-value>
API_BASE_URL=https://app.quote.trade/api
LIQUIDITY_WS_URL=wss://app.quote.trade/ws/liquidity
LISTEN_KEY_WS_URL=wss://app.quote.trade/ws/listenKey
MODE=paper
TELEGRAM_SESSION_ENCRYPTION_KEY=<strong-random-secret>
DEFAULT_PAYMENT_CURRENCY=USDT
POSITIONS_ENDPOINT=/positionsThe bot starts in paper mode and can reach public Quote.Trade data. Replace USDT only when the current account and order schema accept another supported payment currency.
Connect credentials only in private chat
The repository documents per-user isolated credentials and a private /connectkey flow. Restrict the command to direct messages, delete sensitive messages when possible, encrypt stored values, and tell users to rotate any credential pasted in the wrong place.
/connectkey <api-key> <api-secret> [sha256|ed25519] [account]The session is stored under that user’s isolated state and is not returned to other users or group chats.
Test account, positions, and risk without live orders
Use read-only permissions first. Run the bot’s account, positions, and risk commands and compare the output with the Quote.Trade app. Confirm logs contain no secrets.
The bot displays account and risk data while paper mode does not submit orders.
Treat AI output as a pending draft
The bot’s AI planner should translate natural language into a proposed command, validate it, and save it pending confirmation. The language model must never send the order directly. Show symbol, side, quantity, USD price, USD notional, account, payment currency, and leverage before confirmation.
AI-generated trades remain drafts until the user confirms them.
Monitor the bot, streams, and local triggers
Like the CLI, local triggers require the process to remain running and connected. Add health checks, restart policy, alerting, backups for encrypted state, key rotation, and a kill switch before real mode.
A stopped process or disconnected stream raises an alert and blocks unsafe actions.
Common problems and fixes
An API secret was posted in a group chat
Delete the message where possible and revoke and rotate the Quote.Trade key immediately. Never connect credentials in a group chat.
The bot restarts and loses trigger state
Restore the encrypted local state, reload current positions and orders, and verify every trigger before resuming real mode.
Telegram shows a successful message but exchange state differs
Use Quote.Trade account, order, and private-event data to confirm what actually happened.