# API key handling and security practices

URL: https://fincodelabs.com/en/security · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Updated: 2026-11-06

This page states how software from Fincode handles exchange API keys, incoming messages and logs. It describes practices, not certifications: Fincode does not claim any third-party security certification.

## How API keys are handled

### Read and trade permissions only

Keys are used with only the permissions required. We do not ask for withdrawal rights.

### IP restriction

Applied where the platform supports it, so a key works only from the server that runs the software.

### Where keys stay

By default the software runs on your own server or cloud account, and keys stay there. They are encrypted wherever they are stored.

### Your account, your key

Orders are sent by the software, on your own account, with your own API key, under the rules you defined. Fincode does not hold client money.

### Rotation and revocation

You can revoke or replace a key from your exchange account at any time. Once a key is revoked, the software can no longer use it.

## Other controls in the software

### Testnet first

Where the platform offers a testnet, development and testing happen there. The switch to a live account comes only after testing is complete and with your approval.

### Incoming webhooks

Every message is checked with a secret and a source check, and unrecognized requests are rejected. Exchange API keys never go in the webhook message.

### Risk limits and emergency stop

Limits such as maximum position size and a daily loss limit run as a layer independent of the trading rules, alongside an emergency stop. In production they are enabled by default.

### Logs

Orders and system events are logged with timestamps, so you can see what the software did and why.

## What this page does not claim

Fincode does not claim any third-party security certification. No software can rule out every failure: outages caused by the exchange, the server or the connection cannot be ruled out entirely.

When the software runs on your own server, the security of that server and of your account credentials stays with you. If a project needs a different setup, the written scope says where the software runs. The [privacy policy](https://fincodelabs.com/en/privacy) and [terms of use](https://fincodelabs.com/en/terms-of-use) describe how project data and keys are treated.

Fincode is a software company and does not provide investment advice, portfolio management or crypto asset services. Trades can lose money.

### Read next

- [API key security for trading bots](https://fincodelabs.com/en/blog/api-key-security-trading-bots)
- [How we work and what you receive](https://fincodelabs.com/en/how-we-work)
- [Trading bot code review](https://fincodelabs.com/en/services/trading-bot-code-review)

## Questions about security

### Do you need withdrawal permission?

No. Software from Fincode works with read and trade permissions; we do not ask for withdrawal rights.

### Will Fincode hold my API keys?

By default keys stay on your own server or cloud account, and you enter them yourself. For development and testing, test-environment keys are used wherever the platform offers them.

### Can I put my exchange API key in a TradingView webhook message?

No. TradingView asks users not to send credentials in webhooks. The message carries only a separate secret known to the bridge.

### Is Fincode certified to a security standard?

Fincode does not claim any third-party security certification. This page lists practices instead.

### Who decides what the software trades?

You do. The software follows the rules you defined. Fincode does not make trading decisions in your account and does not watch your positions.

## Report a security problem

If you find a security problem on fincodelabs.com or in software from Fincode, email [info@fincodelabs.com](mailto:info@fincodelabs.com?subject=Security%20report) with "Security report" in the subject line. Say what is affected, how to reproduce the problem and what someone could do with it.

Test only with accounts and data that are yours. Do not access or change other people's data, do not run tests that slow down or interrupt the site or its forms, and do not send API keys, passwords or other people's personal data in your report.

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/security