Security & custody

The short version: **OpenSwap never holds your money and never sees your keys.** It finds you a route and gives you a deposit address; your own wallet does the paying. There's no seed phrase to enter, no browser extension, and no account — which means there's nothing here to steal.

How a swap actually works

When you confirm a swap, the route provider creates a deposit address — a normal blockchain address that belongs to the swap. You pay it from any wallet you already trust, the provider does the crosschain exchange, and funds arrive at your destination address. The CLI's job is to compare routes, validate everything, and keep the receipt. It's a guide, not a custodian.

The one exception is explicitly opt-in: the bot signer for automated trading, which is never part of the human flow.

What protects you during a swap

Destination and refund addresses are validated for the right chain, and

known placeholder addresses are rejected outright.

The final quote is re-created bound to your destination before you

review it, and confirming means typing SWAP — not just hitting Enter.

Amounts are recomputed with exact integer math, and the QR code is only

shown if it agrees perfectly with the validated address and amount.

Routes that need extra metadata a plain address can't carry are refused on

the QR path rather than risking a mis-send.

Your receipt is saved before payment instructions appear, so a crash or

closed laptop can't lose a swap.

If an outcome is ever unknown, the error says funds_may_have_moved

honestly and nothing is blindly retried.

How API keys are handled

Your key is looked up in this order: the OPENSWAP_API_KEY environment variable → the operating system's keychain (via openswap auth login) → the built-in community key. Keys are typed in privately, never accepted as command-line flags, never written to files or receipts, and never sent anywhere except the official API.

The community key being public is intentional: it can fetch quotes and prepare swaps, and that's all — it cannot move funds and cannot read anything private.

The optional signing wallet

If you set one up, openswap wallet setup recommends **creating a fresh dedicated wallet** rather than importing your main one. It's generated locally, encrypted on disk, and asks for its passphrase at every signing. Keep only active trading balances on it.

Privacy

There is no telemetry. Receipts and logs stay on your machine with restrictive permissions and contain no credentials. The one thing that ever leaves your machine voluntarily is openswap feedback — and it shows you the exact, redacted diagnostics and asks for consent before sending.

Found a security problem?

Please report it privately — see the security policy for the disclosure process. Don't open a public issue for an exploitable finding, and don't send it through openswap feedback (that posts to a team chat channel, which isn't confidential).