Protecting Your Account
Protect your sign-in account with a strong second factor and keep trading keys restricted to the systems that use them.
Sign-In and Recovery
Section titled “Sign-In and Recovery”Use a unique password and a password manager for your email or identity-provider account. Keep recovery methods current and open account links from the trade8.xyz domain. Enter Apple or Google credentials only in that provider’s authentication flow.
Keep devices updated and locked when unattended. Share access through authorized user accounts rather than sharing passwords or recovery codes.
API-Key Setup
Section titled “API-Key Setup”| Control | Practical Setup |
|---|---|
| Permissions | Give a market-data process market:read; give reconciliation the required read scopes; add orders:write only to a process authorized to trade |
| Account grants | Restrict the key to its strategy’s account or subaccount |
| IP allowlist | Allow the server’s outbound addresses; update the list before moving infrastructure |
| Secret storage | Store secrets in a secret manager or server environment, outside browser code and repositories |
| Separation | Use different keys for strategies, environments, and operators |
| Expiry and rotation | Track expiry dates; replace exposed keys and remove departing operators’ access |
Read Authentication & API Keys for scopes, signing, and expiry behavior. Keep transfer and collateral-allocation permissions separate from market-data access.
If a Key Is Exposed
Section titled “If a Key Is Exposed”- Stop the affected process and revoke the key through the issuing account’s access controls.
- Reconcile open orders, fills, positions, transfers, and collateral allocations. Check activity since the earliest possible exposure.
- Replace the key, update the authorized process, and check logs or repositories for additional copies.
- If the sign-in identity was compromised, secure it through the email or identity provider’s official recovery process.
Contact Us with “Security” in the subject, the affected key ID, account reference, incident time, and observed activity. Send identifiers and redacted evidence; keep secrets, seed phrases, and recovery codes private.