Exchange keys

Exchange keys are kept not by the trading server but by a separate order executor. A key is encrypted on your device, and neither the trading server nor support sees it. The executor sends opening orders only within the permission signed by your device.

Order executor

The order executor is a separate server, the only one that has exchange API keys. It makes all private exchange calls: orders, account streams, balances. The trading server stores only a reference to the key (the exchange and the key number) and cannot read the key itself: the protocol between them has no command that would return the key.

There can be several executors; each exchange is assigned to one. Their list — the executor registry — is signed with the Profit Cloud release key, and the registry number can only grow: the app checks the signature itself and will not accept a substituted or old registry. From the registry, the connection wizard shows the addresses for the key's whitelist.

No connection to the executor — see "Trading → Execution → No connection to the executor".

Key encryption

When a connection is added, the app encrypts the API key, the secret and the key passphrase on your device with the order executor's public key (ECDH P-256, HKDF-SHA256, AES-256-GCM) and signs the result with the device key (see "Devices"). The trading server passes only the encrypted package to the executor; the executor checks the device's signature before decrypting.

The encrypted key is valid for 10 minutes: if the time on the device is wrong, the executor will not accept it. The app takes the executors' public keys only from its own release or from the signed registry.

Bundle permission. When saving a bundle, the device signs: the bundle and its version, the signing time and, for each leg, the connection, exchange, market, instrument, "Position limit" and "Leverage" (see "Trading → Bundle → Position limit", "Trading → Bundle → Leverage"). The order executor:

• always executes reads, cancellations and exits — reducing a position on perpetual contracts and selling on spot;
• executes opening orders only under a valid permission for this instrument and market, and only if the leg's position together with pending orders and the new order will not exceed the signed "Position limit";
• will not set leverage on the exchange above the signed "Leverage".

The app decides whether a bundle is signed from the executor's signed receipt, not from the server's word. Archiving revokes the permission. A permission falls asleep after 72 hours without opening orders while the legs are empty — the bundle has to be signed again.