# Crypto trading bot developer: what to check before hiring

URL: https://fincodelabs.com/en/blog/crypto-trading-bot-developer · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Trading bots · Published: 2026-11-05 · Updated: 2026-11-05

Hiring a crypto trading bot developer? What to specify, what to demand, how keys are handled, how to write acceptance tests and when to walk away.

**Short answer:** To hire a **crypto trading bot developer**, write your own trading rules first, then judge candidates on what they deliver: source code, a testnet test report, a runbook and risk limits that sit outside the strategy code. Your keys stay on your server with read and trade permission only, and acceptance tests describe how the software behaves, never how much it earns. Automated trading can lose money, and no developer can promise otherwise.

Listings make every trading bot developer sound alike, and a demo only shows the case where nothing goes wrong. Candidates differ at the edges: a restart with an open position, an order that fills in three pieces, an exchange error in the middle of a trade.

This is a buyer's checklist for hiring one developer or a small team. What drives the price is covered in [trading bot cost](https://fincodelabs.com/en/blog/trading-bot-cost) and the architecture in [trading bot development](https://fincodelabs.com/en/blog/trading-bot-development). Disclosure: Fincode sells this kind of work, so this guide is not neutral on that point. Fincode builds from rules the customer wrote and does not supply strategies. Platform details were read on official pages on 4 November 2026, and naming a platform here is not a recommendation.

## What does a crypto trading bot developer do?

A developer turns rules you wrote into tested software, while the choice of what to trade, when and how much stays with you.

**Who is responsible for what**

| Item | You | Developer |
| --- | --- | --- |
| Trading rules, assets, sizes, limit values | Decide and write them | Implements them and asks where they are ambiguous |
| Exchange account and API keys | Own and create them | Works with testnet or sandbox keys only |
| Code, tests, runbook | Receive them under the contract | Writes them |
| Going live, raising size, stopping | Decide | Provides the controls |

Titles such as Python trading bot developer, algo trading bot developer, algorithmic trading developer and trading bot programmer describe the same work, so judge the deliverables rather than the title.

The split is also a legal line in many places: picking trades or running accounts for other people can be a licensed activity, as the [guide to evaluating a development company](https://fincodelabs.com/en/blog/crypto-bot-development-company) explains. Which platforms a bot may use depends on your jurisdiction and the platform's terms. For readers in Turkey, Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized, and the Capital Markets Board said on 5 August 2024 that appearing on its list of operating platforms does not mean authorization.

## The written rule document you should own

Write the rule document before you contact anyone, because it is what the developer builds against, what quotes are compared against and what acceptance is tested against.

- **Market and account.** Exchange, account type, spot or futures, exact symbols.
- **Entry and exit rules.** Each condition, its timeframe and when it is evaluated: at candle close or on every price update.
- **Order handling.** Order type, time in force, and what happens on a partial fill, a rejection or a timeout.
- **Size and limits.** Maximum order, maximum position and daily loss, in your own numbers.
- **Failure behavior.** Restart with an open position, exchange downtime, stale data, a price gap.
- **Stopping.** Who can stop the bot, who can restart it and who gets the alert.

> **Hypothetical excerpt, with placeholders for your own values.** R4: evaluate the entry condition only at candle close on [timeframe]. R5: send a limit order for [quantity] at [price rule]. R6: if the order is partly filled after [seconds], cancel the rest and manage only the filled quantity. R7: on restart, read open orders and balances from the exchange before any new order; if they differ from the local record, send an alert and place nothing.
>
> The content of R4 and R5 is your decision. R6 and R7 are behavior a developer can be held to.

A developer can point out where a rule is ambiguous; one who offers to fill the gaps with a strategy of their own is selling something else.

## What to demand from a trading bot developer

Demand five things in writing: source code, a test report, a runbook, limits outside the strategy code and a list of what the software depends on.

**Deliverables and how to check them**

| Deliverable | What it contains | How to check it |
| --- | --- | --- |
| Source code | Full repository with history, build steps and pinned dependencies | Build it yourself on a clean server |
| Testnet test report | Each case with environment, date, result and log excerpt, failures included | Re-run two cases you choose |
| Runbook | Start, stop, restart, key rotation and the meaning of each alert | Follow it without the developer's help |
| Limits outside the strategy code | Order, position and loss limits plus a kill switch in a separate layer | Try to breach each one on testnet with a deliberately wrong signal |
| Dependency list | Libraries and their licenses, exchange API versions, data sources | Check licenses before any commercial use |

The separate risk layer is explained in [trading bot risk management](https://fincodelabs.com/en/blog/trading-bot-risk-management). Ask which test environment will be used and what it cannot show, because environments differ. As of 4 November 2026, Binance says its Spot Testnet's prices and order books are independent from the live exchange, and Kraken lists Spot UAT as available on request through an account manager, with a self-service demo for derivatives. A test report therefore proves how the software behaves, not how it would fill in a live market.

## How a developer should handle your API keys

Keys stay with you: you create them, they carry read and trade permission only, never withdrawal, and they live on your own server.

1. **During development** the developer uses testnet or sandbox keys, so no production key is needed. Venues differ here, so settle first how a venue without a self-service sandbox gets tested.
2. **At go-live** you create the production key yourself and place it directly in your server's secret store, rather than sending it by chat or email.
3. **When the work ends** you rotate the key.

Exchanges expose these controls differently, so ask which permission the software needs on your platform.

**Key permissions on three official pages, read 4 November 2026 (alphabetical)**

| Platform | What the page says |
| --- | --- |
| Binance | Withdrawal permission requires an IP restriction, and by default a system-generated HMAC key without one can only read |
| Bybit | A key is marked read only or read and write, Withdraw is a separate wallet permission on the master account, and a key with no IP bound carries an expiry |
| Kraken | Separate permissions cover creating orders, canceling orders and withdrawing funds, and the guide advises the minimum a key needs |

If a candidate asks for more than read and trade and cannot explain why, end the conversation. Storage, rotation and logging are covered in [API key security for trading bots](https://fincodelabs.com/en/blog/api-key-security-trading-bots).

## Acceptance tests that describe behavior, never profit

Accept the work against tests of what the software does under failure, because no test can show what it will earn.

**Example acceptance tests**

| Test | Pass condition |
| --- | --- |
| Restart with an open position and working orders | Reads state from the exchange, creates no duplicate order, sends an alert |
| Partial fill | Position and exit logic use the filled quantity only |
| Order request times out | Looks the order up by client order ID before any resend |
| Rate-limit reply | Stops and waits as instructed, such as HTTP 429 with Retry-After on Binance (limits page, read 4 November 2026) |
| Order breaches a limit | Blocked outside the strategy code, logged and alerted |
| Kill switch pulled | New orders blocked and working orders canceled within the time in your document |
| Market data stops | No new positions until data recovers |
| Host clock drifts | Alert before signed requests start failing |

Refuse any criterion such as a backtest return above a set figure: results can be tuned to clear it, as [backtesting pitfalls](https://fincodelabs.com/en/blog/backtesting-trading-strategy-pitfalls) shows, and it rewards the wrong work. Reports show how the software behaves, not future results, and trades can lose money.

## Maintenance scope and code ownership

Settle both in writing before work starts, because exchange APIs keep changing and code rights do not transfer by themselves.

Binance's Spot API changelog has 32 dated entries for 2026 as of 4 November 2026, and Bybit's WebSocket page, read on 5 November 2026, lists a limit of 100 args per connection for Spot and Futures with the start date marked TBD.

- **Maintenance covers** API compatibility, defect fixes, dependency updates and an agreed response time.
- **Maintenance excludes** strategy changes, position monitoring and trading decisions. Those stay with you.
- **Fees** depend on scope and effort, not on trading volume or results.
- **Ownership:** the contract says who owns the code and from when, and the repository sits in your account or you receive a full copy at every milestone.

### Freelancer or small team?

An algo trading developer freelancer and a small team can both do this work, and the deciding question is continuity: could someone else take over using only the repository and the runbook? Ask who covers an absence.

## Red flags when hiring a crypto bot developer

Walk away when the offer depends on returns, on someone else's signals or on control of your money.

**Red flags and why they matter**

| Red flag | Why it matters |
| --- | --- |
| Promised returns or profit screenshots | A developer can answer for behavior, not markets. The CFTC's customer advisory of 25 January 2024 says: "AI technology can't predict the future or sudden market changes." |
| Ready-made signals or a bundled winning strategy | You are no longer buying software, and selling signals can be regulated where you live |
| Profit share or performance fee | It rewards risk taken with your money and usually needs control of your account |
| Request for withdrawal keys, deposits or your login | The software needs none of them |
| Sniper, volume or wash-trading bots on the menu | Wash trading and other market abuse are prohibited in many jurisdictions, and a seller of these tools has shown you its standards |

The same advisory suggests quick checks: research the person or company, run a reverse image search on key personnel, check how old the website is through domain registration records and get a second opinion.

## How to compare quotes from trading bot developers

Compare quotes only against the same rule document and the same deliverables list, because headline prices rest on different assumptions.

1. Send every candidate the same document, and ask for effort by work package and a list of exclusions.
2. Ask who pays when an exchange changes its API during the project.
3. Ask which row of the deliverables table a low quote leaves out.

No independent survey of developer rates was found. The figures below are one marketplace's own summary, so read them as seller data: they say nothing about testing, quality or what is included.

**Fiverr's crypto trading cost guide, updated 3 August 2026, read 4 November 2026 (seller data, not a benchmark)**

| Item as described | Figure |
| --- | --- |
| Trading bot development, standard | Averages around $116 |
| Advanced custom bot work, 2 to 4 weeks | $250 to $500 in one passage, $200 to $300 in another |
| Technical development, hourly | $35 to $50 |

The factors that actually move effort are in [trading bot cost](https://fincodelabs.com/en/blog/trading-bot-cost). To see how one seller states its own deliverables, read the [custom trading bot development](https://fincodelabs.com/en/services/algorithmic-trading) and [how we work](https://fincodelabs.com/en/how-we-work) pages, and ask about anything on this checklist they do not cover.

## Frequently asked questions

### How much does a crypto trading bot developer cost?

It depends on scope, testing and maintenance, and published figures are seller data rather than a survey. Compare quotes against the same rule document and the same deliverables list.

### Should a developer have my production API keys?

No. Development and testing use testnet or sandbox keys; if a venue has no self-service sandbox, settle first how it gets tested. You create the production key, with read and trade permission and no withdrawal right, and install it on your own server.

### Can a developer supply a strategy that works?

A developer's job is to build your rules correctly. No one can promise a trading result, and a seller of strategies or signals is offering something different that may be regulated where you live.

### Do I need a Python trading bot developer specifically?

Not necessarily. Python has useful libraries and is widely known, but tests, logs, limits and maintainability matter more than the language.

## Sources

- [CFTC Release 8854-24 (25 January 2024): Customer Advisory: AI Won't Turn Trading Bots into Money Machines](https://www.cftc.gov/PressRoom/PressReleases/8854-24)
- [Binance Support: How to Create API Keys on Binance (permissions and IP restrictions)](https://www.binance.com/en/support/faq/detail/360002502072)
- [Binance Spot API documentation: Limits (HTTP 429, Retry-After)](https://developers.binance.com/en/docs/products/spot/rest-api#limits)
- [Binance Spot API documentation: Demo Mode (testnet and demo mode compared)](https://github.com/binance/binance-spot-api-docs/blob/master/demo-mode/general-info.md)
- [Binance Spot API: CHANGELOG](https://github.com/binance/binance-spot-api-docs/blob/master/CHANGELOG.md)
- [Bybit V5 API: Get API Key Information (permission fields, read only flag, expiry)](https://bybit-exchange.github.io/docs/v5/user/apikey-info)
- [Bybit V5 API: WebSocket Connect (args limits, start date TBD as of 5 November 2026)](https://bybit-exchange.github.io/docs/v5/ws/connect)
- [Kraken: API key permissions](https://docs.kraken.com/exchange/guides/rest/api-keys)
- [Kraken Developers: Exchange overview (sandbox: Spot UAT on request, derivatives demo)](https://docs.kraken.com/exchange/guides/overview)
- [Fiverr: Crypto trading expert cost guide (marketplace seller data, updated 3 August 2026)](https://www.fiverr.com/resources/guides/costs/crypto-trading-expert)
- [Capital Markets Law No. 6362, consolidated text, Article 99/A (Turkish)](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf)
- [SPK (Capital Markets Board): Announcement on crypto-asset service providers, 5 August 2024 (Turkish)](https://spk.gov.tr/duyurular/basin-duyurulari/2024/kripto-varlik-hizmet-saglayicilara-iliskin-duyuru_05082024)

> This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy).

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/crypto-trading-bot-developer

Cite as: Fincode, "Crypto trading bot developer: what to check before hiring", updated November 5, 2026, https://fincodelabs.com/en/blog/crypto-trading-bot-developer