Topstep Automated Trading: Rules, Limits & What to Know
Heads up: some links below are affiliate links. If you sign up through them we may earn a commission at no extra cost to you - it never changes what we recommend.
Yes. Topstep allows custom automated strategies and bots through its own TopstepX and ProjectX API, subject to platform rules and a prohibition on high-frequency trading. The restriction that catches people out is not about automation at all. All trading activity has to originate from your personal device, so running the same bot from a VPS, a VPN or a remote server is prohibited and can cost you the account.
The LPFT Copilot runs a rules-based method on your own machine and your own account, with the daily loss limit built in. Start a 7-day free trial and watch it work.
Start your 7-day free trialThe short answer, and the thing most write-ups get backwards
Topstep allows bots. Their own rules page says custom automated strategies and bots are allowed via the TopstepX and ProjectX API, subject to standard platform rules and their prohibition on high-frequency trading. If you have read somewhere that Topstep bans API automation, that is out of date, and this article said it too until we re-read their page on 19 September 2026.
The rule that actually bites is a different one, and it is unusual enough that people miss it entirely: all trading activity must originate from your personal device. VPS hosting, VPNs and remote servers are prohibited by their terms of use. So the question Topstep cares about is not "is a human clicking" but "which machine sent the order".
Prop firm rules change without notice, and this one changed. Read the current version on Topstep's own help centre before you automate anything, and screenshot the page on the day you sign up. A summary is a starting point, never an authority.
What you may and may not run on a server
Topstep draws the line precisely, and it is worth reading the distinction slowly because it permits more than most traders assume. On your own infrastructure you may keep historical data, run research, backtest, log everything and build read-only dashboards. What you may not do there is place, modify or cancel an order.
Topstep put it as plainly as anyone could: your server can watch and record, but it cannot trade.
That is genuinely useful if you were assuming automation meant a cloud box humming away while you sleep. On Topstep it means your own machine has to be awake and connected, and your research stack can live anywhere you like as long as it never touches the order path.
The consequence, and why it is worth taking seriously
Topstep states that running automation on a VPS can result in account suspension or removal from the program. That is not a warning about a strategy losing money. It is a rule you can break while being profitable, which is the category of prop firm rule that ends the most accounts.
- High-frequency trading is prohibited by name, on top of the automation allowance. If your strategy trades at that pace, the fact that bots are permitted does not help you.
- The device rule applies even to a strategy that never touches the API. It is about where the order comes from, not how it was built.
- Read-only is genuinely read-only. A dashboard that can also cancel an order is no longer a dashboard.
If you want the wider picture of how firms differ on exactly these points, we compared the published rules side by side in which prop firms allow high-frequency bots. The short version is that most firms ban the word HFT while allowing ordinary automation, and the conditions they attach are where the real differences sit.
How this compares with the rest of the field
Topstep sits in an interesting spot. Allowing bots through a first-party API is more permissive than several firms manage, while the personal-device requirement is stricter than most. TradeDay, for instance, restricts VPN and VPS use specifically where it masks the location of the trading, which is a narrower rule than Topstep's blanket one. Flattening those two into "no VPS anywhere" would be wrong.
The practical takeaway is that "does this firm allow bots" is the wrong question to lead with. The useful questions are whether the system has to be yours, whether a human has to be watching, whether there is a cap on trades per day, and which machine is allowed to send the order. Those four decide far more outcomes than the headline policy does.
The LPFT Copilot runs the whole stack for you on Tradovate - start a 7-day free trial and watch it work.
Start your 7-day free trialSo can you automate on Topstep? A practical read
Yes, within two clear limits. Build or run your automated strategy through TopstepX or ProjectX, keep it well away from high-frequency territory, and make sure the orders leave from the computer in front of you rather than from a hosted box. Keep your research and logging wherever you like, provided it cannot trade.
And re-read their rules before each new account. This post was wrong for several weeks because their policy changed and ours did not, which is the honest argument for checking the source rather than trusting any summary, including this one.
For a wider view of how firms differ, see which prop firms actually allow automated trading and bots, and for the funded account case specifically, running a bot on a prop firm account.
Frequently asked questions
Yes. Topstep allows custom automated strategies and bots via the TopstepX and ProjectX API, subject to standard platform rules and a prohibition on high-frequency trading. Their rules changed on this point, so check the current version on their help centre before you rely on it.
Yes. The TopstepX and ProjectX API is the permitted route for custom automated strategies. The separate restriction is that the order has to originate from your personal device.
No. Topstep requires that all trading activity originates from your personal device, and prohibits VPS, VPNs and remote servers in its terms of use. They state this can result in account suspension or removal from the program.
Yes, for everything except trading. Historical data storage, research, backtesting, logging and read-only dashboards are permitted on private infrastructure. Placing, modifying or cancelling orders from there is not. In their words, your server can watch and record, but it cannot trade.
No. HFT is prohibited by name, and that prohibition sits alongside the allowance for custom automated strategies. A bot is fine, a bot operating at high frequency is not.
Yes. Topstep previously restricted API automation, and their current page allows custom bots through the TopstepX and ProjectX API. That is exactly why you should read their live rules page rather than any third-party summary, this one included.
Eli Y.
Eli builds and runs rules-based automated futures systems on TradingView and Tradovate, and helps traders take emotion out of the screen. He writes about futures automation, prop-firm evaluations, and the tools that connect them - plainly, and without hype.
Risk disclosure: Trading futures involves substantial risk of loss and is not suitable for everyone. This article is educational content only and is not financial advice or a recommendation to trade. Past performance is not indicative of future results. Some links are affiliate links.