Safe setup without exchange keys
A paper account should be useful before any exchange credential enters the conversation. Start with watchlist rules, manual marks, journal fields, and review permissions. If a separate external tool ever asks for exchange access, treat that as a separate safety review and use the trading API key safety checklist first.
The safest default is to keep paper trading evidence separate from live-account permissions. A simulated account can still record thesis quality, rule adherence, drawdown behavior, missed trades, and review notes. None of those require withdrawal access, custody, or order-routing privileges.