API key handling and security practices
This page states how software from Fincode handles exchange API keys, incoming messages and logs. It describes practices, not certifications: Fincode does not claim any third-party security certification.
How API keys are handled
Read and trade permissions only
Keys are used with only the permissions required. We do not ask for withdrawal rights.
IP restriction
Applied where the platform supports it, so a key works only from the server that runs the software.
Where keys stay
By default the software runs on your own server or cloud account, and keys stay there. They are encrypted wherever they are stored.
Your account, your key
Orders are sent by the software, on your own account, with your own API key, under the rules you defined. Fincode does not hold client money.
Rotation and revocation
You can revoke or replace a key from your exchange account at any time. Once a key is revoked, the software can no longer use it.
Other controls in the software
Testnet first
Where the platform offers a testnet, development and testing happen there. The switch to a live account comes only after testing is complete and with your approval.
Incoming webhooks
Every message is checked with a secret and a source check, and unrecognized requests are rejected. Exchange API keys never go in the webhook message.
Risk limits and emergency stop
Limits such as maximum position size and a daily loss limit run as a layer independent of the trading rules, alongside an emergency stop. In production they are enabled by default.
Logs
Orders and system events are logged with timestamps, so you can see what the software did and why.
What this page does not claim
Fincode does not claim any third-party security certification. No software can rule out every failure: outages caused by the exchange, the server or the connection cannot be ruled out entirely.
When the software runs on your own server, the security of that server and of your account credentials stays with you. If a project needs a different setup, the written scope says where the software runs. The privacy policy and terms of use describe how project data and keys are treated.
Fincode is a software company and does not provide investment advice, portfolio management or crypto asset services. Trades can lose money.
Questions about security
Do you need withdrawal permission?
No. Software from Fincode works with read and trade permissions; we do not ask for withdrawal rights.
Will Fincode hold my API keys?
By default keys stay on your own server or cloud account, and you enter them yourself. For development and testing, test-environment keys are used wherever the platform offers them.
Can I put my exchange API key in a TradingView webhook message?
No. TradingView asks users not to send credentials in webhooks. The message carries only a separate secret known to the bridge.
Is Fincode certified to a security standard?
Fincode does not claim any third-party security certification. This page lists practices instead.
Who decides what the software trades?
You do. The software follows the rules you defined. Fincode does not make trading decisions in your account and does not watch your positions.
Report a security problem
If you find a security problem on fincodelabs.com or in software from Fincode, email info@fincodelabs.com with "Security report" in the subject line. Say what is affected, how to reproduce the problem and what someone could do with it.
Test only with accounts and data that are yours. Do not access or change other people's data, do not run tests that slow down or interrupt the site or its forms, and do not send API keys, passwords or other people's personal data in your report.
Send a short brief
Tell us the platform you use, what the software should do and your timeline. Do not include API keys or private rules in your message.