Hi,
I want to integrate bitcoin deposits in to my website.
Great idea!
Such that each user has a unique address
No.
This is not the best way to handle it. Users should not be re-using addresses to add additional funds to their account. Instead, the user should be provided with a New Address for each transaction. You'll want to keep track of all the addresses you've ever given to a user, just in case they do something stupid and send to an address that they've sent to in the past, but your website should provide a new address for each funding transaction.
and their account can be credited with "tokens" after depositing BTC and clearing confirmation.
Correct. You'll maintain a database of accounts and keep track of what the value is on each account as the users either add, remove, or use funds.
I would like each users account to transfer BTC automatically to a single hot wallet after it has been received by their unique wallet. OR something to that effect.
No.
The addresses that you give to users to fund their accounts should come from the cold wallet. That way, when the users send in the funds, they are already safely secured in the cold wallet.
Hot wallets are risky. You do not want all your bitcoins sitting in a hot wallet. You should only have enough bitcoins in a hot wallet for short term use, and only an amount that you can afford to lose. The rest of your bitcoins should be held in a cold wallet. The hot wallet can be funded from the cold wallet when necessary, BUT you'll want to have a very secure process for adding these funds to the hot wallet, and you'll want to be aware of how much and how often you are funding that hot wallet. You don't want to be arbitrarily funding a hot wallet that has run low on funds if the reason that it is low on funds is that a hacker has gained access to it.
Currently I know of creating a database, generating a batch of keys using
https://www.bitaddress.org/ or something and then using that file to populate user data.
Is there an easier way of doing this?
Rather than pre-generating a "batch of keys", it would probably be better to use deterministic keys. This way, the single seed for the private keys can be safely stored in the cold wallet, and you can then generate on-the-fly and store in your database as many addresses as you need when you need them.
Are there any APIs out there that don't require me to pay merchant fees?
Yes, but they may not be as easy to use and may require more knowledge of how bitcoin works at a technical level. They'll also probably require you to run your own bitcoin node/server.
