How are exchange API credentials stored?
API keys, secrets and passphrases are stored encrypted and are not displayed in plain text in the normal interface after saving. No connected system can promise zero risk, so permission limits, IP allowlists and key rotation remain essential.
What can Quanton do through an API?
- Read balances, orders and position status.
- Place, cancel and query orders for user-enabled strategies.
- Record outcomes for status display and trade review.
Which permissions are not required?
Exchange strategies do not require withdrawal or transfer rights. Disabling withdrawal does not eliminate trading loss because trade permission can still place orders.
How can users reduce risk?
- Create a dedicated API instead of reusing another bot's key.
- Enable read and trade only; disable withdrawal and transfer.
- Enable an exchange IP allowlist when available.
- Start with paper trading and a small live allocation.
- If activity looks abnormal, revoke the API at the exchange first.
When is a wallet private key involved?
Regular exchange strategies and paper trading do not need one. A dedicated signing wallet is relevant only when a user explicitly enables live on-chain trading, which introduces separate smart-contract, token, approval, RPC, gas, MEV and irreversible-transfer risks.
Do not use a main wallet holding substantial assets for automated on-chain trading.
Security FAQ
Does Quanton need withdrawal permission?
No. Disable withdrawal and transfer permissions when creating the API.
Do funds enter Quanton accounts?
No. Exchange-strategy funds stay in the user's own exchange account.
Does disabling withdrawal make trading risk-free?
No. Trade access can still place losing orders, and no connected system has absolute security.