HelpKeys and security
What TrueHold can and cannot do with your keys
TrueHold asks for read-only keys, validates them before storing and encrypts them at rest. A read-only key cannot trade or withdraw; revoke it any time.
An exchange API key carries permissions that the exchange enforces. TrueHold asks for read permission only, and the product has no feature that places an order, transfers or withdraws.
What happens to a key
- 01It is validated against the exchange before it is stored, so a key that does not work is never kept.
- 02It is encrypted with AES-256 and is never written to disk in plaintext.
- 03It is used to read balances, positions and history on a schedule, and nothing else.
Revoking
Delete the key on the exchange and TrueHold loses access to that account as soon as the exchange stops accepting the key. Deleting the exchange account inside TrueHold removes the account, its stored key and its synced data from your portfolio. Deleting your TrueHold account does the same for every account at once. The audit guide in the blog walks through checking every key you have ever issued.
Related
Connect an exchange with a read-only API key
Create a read-only key on the exchange, paste it into TrueHold, and balances, positions and history appear. The key is validated before it is stored.
Replace or rotate an API key
Open the exchange account in TrueHold, replace the key from its settings, and the account keeps its history. Expiring keys are flagged in advance.
Delete your account and data
Account deletion removes what you own in TrueHold, from portfolios and stored keys to sync logs and archived payloads, after a typed confirmation.
Still stuck?
Write to hello@truehold.xyz with the screen you are on. Answers become docs, so the next person finds it here.