Documentation

Creating a read-only API key

You do this once per exchange, on the exchange website (easier than the app). It takes about three minutes. Bybit first, Bitget below.

Bybit

1. Log in to Bybit in a browser. Click your profile icon at the top right, then choose API from the menu. (If you do not see it, open Account and Security and look for API Management.)
2. Click Create New Key. When asked what type, choose System-generated API Keys. Do not choose the self-generated (RSA) option.
3. For API key usage, select API Transaction. In the name field, type something you will recognize later, like p2proof.
4. This is the important screen. Under permissions, select Read-Only. Do NOT tick anything under Trade, Withdraw, Transfer, or Wallet. A read-only key physically cannot move money; Bybit itself rejects any such attempt. P2Proof will never ask you for more than read access.
5. For IP restriction, choose no IP restriction for now. Important: Bybit automatically expires unrestricted keys after about 3 months. P2Proof tracks your key's age and reminds you (on the dashboard, and by Telegram on Pro) before it expires; replacing it takes a minute.
6. Complete Bybit's security check (2FA code, email code). Bybit then shows the API Key and API Secret. The secret is shown ONCE. Copy both immediately and paste them straight into P2Proof(during onboarding, or in Settings under Bybit API key).
7. P2Proof makes one live test call before saving. If the key works, it is encrypted and stored; if not, you get a plain-language reason (typo, IP restriction, missing permission).

Note: the P2P order API only returns data for accounts with P2P Advertiser status. If your account is not an advertiser yet, the key will connect but show no orders until you have advertiser access on Bybit.

Bitget

Two requirements come straight from Bitget's own documentation, and both are needed before a key will work: your account must hold Advanced Merchant status or above (a higher tier than the basic verified advertiser), and the API key must have the P2P permission ticked when you create it.

1. First, check your merchant tier: on Bitget open P2P, then Advertiser Privileges (the merchant application page). If you are a basic verified advertiser, apply to upgrade to Advanced Merchant. The P2P API only opens at that tier.
2. Log in to Bitget in a browser. Hover over your profile icon and choose API keys (under Account settings), then Create API key and pick System-generated API key.
3. Bitget asks you to set a passphrase. This is a third credential you invent yourself (not your account password). Write it down; P2Proof needs all three: key, secret, and this passphrase.
4. Under permissions, tick the P2P permission and set it to Read-Write. This is a Bitget quirk we confirmed against their live API: unlike Bybit, Bitget rejects read-only P2P keys even for simply viewing your own orders (error 40014, "need P2P write permissions"). P2Proof still only ever READS your data; the write scope is required by Bitget to open the P2P API at all. What keeps you safe is what you leave OFF: do not tick withdrawal, transfer or wallet scopes, so the key cannot move funds no matter what.
5. Skip IP allowlisting (leave it empty) unless we publish a fixed IP for you to bind.
6. Complete the security check, then copy the API key and secret (shown once), and paste key, secret and your passphrase into P2Proof.
7. Heads up on retention: Bitget only keeps about 90 days of P2P history (half of Bybit's 180), so connecting early matters even more there.
8. If bitget.com does not open on your network (some providers block it), use Bitget's official alternate domain bitgetapp.com; your account and settings are identical there.

What P2Proof can and cannot do with your key

These limits are enforced by the exchanges themselves, not by our promises: a read-only key carries no Write, Trade, Transfer or Withdrawal permission, and both Bybit and Bitget reject any such request at the exchange level before it reaches your account. On our side, your API secret is encrypted with AES-256-GCM (the same standard used for military and banking data) before it touches the database, decrypted only inside the server sync process, and never sent back to any browser. Even in the worst imaginable database breach, an attacker would hold ciphertext for keys that could only ever read order history anyway.

How profit is calculated

The easy way: trading runs

A run is one batch of coins you bought. Enter your budget (say ₦1,500,000) and the rate you bought at (say ₦1,480 per USDT); P2Proof works out that you have about 1,013 USDT. Before you commit you can add an expected sell rate to preview your profit. As your real sell orders arrive, the run fills up and shows exactly what you earned. Runs finish in the order you opened them, so you can have several going at once. When a run sells out, Pro users get a Telegram message with the total earned. This works whether you bought the USDT on the exchange or anywhere else, because you simply tell it your buy rate.

The advanced way: cost basis

• Only orders with status Completed count. Cancelled and in-progress orders are stored but excluded.
• Manual mode: you set your average acquisition rate per currency, with effective dates, so updating it never rewrites old profit.
• Auto mode (Pro): each sell's cost is derived from your own completed exchange buy orders, consumed oldest-first (FIFO). Sells older than your buy history fall back to manual rates.
• The platform fee is charged in the token, so it is converted at the order's own rate.
• Trades in different currencies are totaled per currency, never mixed; the USD view converts explicitly with daily FX rates.

Why connecting early matters

Bybit retains P2P order history for roughly 180 days; Bitget for roughly 90. Anything older is unrecoverable, by anyone. P2Proof can only save what still exists at the moment you connect, so the day you connect determines how far back your permanent record reaches. After connecting, scheduled syncs run every six hours and nothing falls off the edge again.

What Pro adds (₦3,000 per month)

• Telegram alerts. Connect the P2Proof bot from Settings and get messages when a sync finds new trades, when your key stops working, and when a market rate crosses a threshold you set (checked every 30 minutes, at most one ping per alert per 6 hours). The bot only sends; it never asks for anything.
• Evidence PDF per trade. One click on any trade produces a one-page document: order ID, timestamps, counterparty, amounts, and a plain-language explanation of P2P escrow, ready to send to a bank the moment a transfer is questioned.
• Bank statement matching. Upload your statement as CSV and every credit is matched to the exact trade behind it (same amount, within 3 days). Matched rows prove your account flow is explained; unmatched credits get flagged early.
• Auto cost basis (FIFO). If you buy USDT on Bybit, Pro can compute each sell's true cost from your own buy orders automatically. No more guessing your average rate.
• Referral rewards. Share your personal link; every friend who subscribes earns you a free month, applied automatically.

FAQ