API
The connective tissue of the platform — every capability is one API call away.
An API (Application Programming Interface) is a contract that lets one system request data or actions from another over the network. Blind Monkeys is built almost entirely out of APIs: an exchange API for trading, a messaging API for alerts, market-data APIs for scanning, seven LLM APIs for AI visibility, and Google Cloud APIs for infrastructure. The platform owns no servers, holds no custody — it orchestrates APIs.
Why APIs are the platform
Every meaningful thing Blind Monkeys does is an API call:
- Seeing the market — price, volume, and market-cap data come from exchange APIs
- Deciding — scans, scores, and regime detection run on data pulled via API seconds earlier
- Acting — opening a grid bot or futures order is an authenticated API call to Bybit
- Reporting — every open, close, and profit is pushed through the Telegram Bot API
- Learning — the AI-visibility checker and learned weights both consume API responses
The non-custodial design follows directly from this: the platform never holds funds because it only ever sends instructions to the exchange, under your keys, with your risk settings.
The APIs we use
| API | Provider | What it does for us |
|---|---|---|
| Trading | Bybit | Places grid bots and futures orders; reads positions, P/L, funding, and wallet balances |
| Market data | Binance (spot) | Coin prices, volumes, and market caps that feed the scanners |
| Alerting | Telegram Bot | Multi-channel messages for new grids, closures, profits, and futures events |
| DNS & security | Cloudflare | Turnstile CAPTCHA on contact forms; zone management |
| Analytics | Cloudflare GraphQL | Site visitors and crawler activity on the analytics pages |
| AI visibility | OpenAI, Anthropic, Perplexity, Gemini, DeepSeek, xAI, Mistral | Daily probes asking each LLM what it knows about the site |
| Zoho SMTP | Delivers contact-form messages | |
| Macro data | FRED | Treasury yields and VIX feeding the market-regime model |
| Geo lookup | DB-IP | Approximate visitor location for diagnostics |
| Infrastructure | Google Cloud | Secret Manager, Cloud Storage, Logging, Scheduler, and Cloud Run deployment |
Internal APIs
The services also expose APIs to each other: the scanner and trader exchange score weights and scan results over authenticated HTTP, and the site itself serves endpoints like /api/scan, /api/rising-coins, and /api/ai-visibility that power the pages and cron jobs. One service's endpoint is another service's dependency.
API security
- Keys never live in code — all credentials are stored as versioned secrets in Google Secret Manager and injected at deploy time
- Least privilege — exchange keys carry only the permissions needed (trade, wallet read), never withdrawal
- Secret-protected triggers — cron and admin endpoints require a cron secret or admin session
- Your keys, your custody — self-hosters supply their own Bybit and Telegram keys, so funds always remain under their control
The platform is less a program than an orchestrator: a set of rules that decides which API to call, when, with what parameters — and everything else (custody, execution, delivery, computation) belongs to the APIs.