HelpKeys and security
What TrueHold can and cannot do with your keys
Keys are read-only, validated before storing and encrypted at rest. They cannot trade or withdraw; revoking one on the exchange ends access at once.
An exchange API key carries permissions that the exchange enforces. TrueHold asks for read permission only, and the product contains no code path that places an order, transfers or withdraws.
What happens to a key
- 01It is validated against the exchange before it is stored, so a key that does not work is never kept.
- 02It is encrypted with AES-256 and is never written to disk in plaintext.
- 03It is used to read balances, positions and history on a schedule, and nothing else.
Revoking
Delete the key on the exchange and TrueHold loses access to that account the same minute. Deleting the exchange account inside TrueHold removes the account and all of its synced data. The audit guide in the blog walks through checking every key you have ever issued.
Related
Connect an exchange with a read-only API key
Create a read-only key on the exchange, paste it into TrueHold, and balances, positions and history appear. The key is validated before it is stored.
Replace or rotate an API key
Open the exchange account in TrueHold, replace the key from its settings, and the account keeps its history. Expiring keys are flagged in advance.
Delete your account and data
Account deletion hard-deletes everything you own in TrueHold, from portfolios and keys to sync logs and archived payloads, after a typed confirmation.
Still stuck?
Write to hello@truehold.xyz with the screen you are on. Answers become docs, so the next person finds it here.