How we protect your API keys

The principle

When you connect a crypto exchange, you paste an API key (trade-only, no withdrawal — see Non-custodial). We treat that key as a secret deserving the highest level of protection.

AES-256 encryption at rest

• Your API key is encrypted with AES-256 before it's stored in our database.
• In storage, the key exists only in encrypted form — no one can read the real value, even by looking directly at the database.

Decrypted only at execution

• The key is decrypted in memory only at the exact moment the Engine needs to place a trade, then discarded right after.
• Outside that moment, the key always stays encrypted.

The secret is never exposed again

• After you paste the key, the secret is never displayed again — not on the dashboard, not in email, not on any screen.
• Our support team cannot see your secret either. If you need to change it, you create a new key and replace it.

You can revoke it anytime

• You can always delete or disable the API key directly on the exchange.
• When the key is revoked, the Engine loses access and stops trading instantly. Your funds and positions remain untouched in your account.
• Step-by-step: see the Revoke access article.

🖼️ [IMAGE PLACEHOLDER] Simple 3-step diagram: (1) You paste the API key → "AES-256" padlock icon → stored encrypted in the database; (2) At trade time, the key is briefly decrypted in memory then wiped; (3) You can revoke the key anytime → Engine stops. Mint accent on dark background, padlock/shield icons.

What about Vietnamese stocks (DNSE)?

For Alpha Stock VN, you create and share no API key at all. You sign a trading authorization (SACO) inside DNSE's Entrade X app. Since there's no key, there's nothing to encrypt — the right to place orders lives in the authorization document, which you can revoke anytime in Entrade X.