> For the complete documentation index, see [llms.txt](https://docs.fluvion.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fluvion.io/api-trading/security.md).

# Security & Troubleshooting

## Protect credentials

Use one dedicated key per integration, least privilege, short expiry where supported, and IP restrictions where practical. Store secrets in an OS keychain or secret manager. Local environment variables are suitable for a controlled development session but can still leak through process inspection, debugging or crash reports.

Never request wallet seed phrases. Never paste API secrets into an AI conversation, commit them, put them in command arguments, or configure them as `VITE_*` variables. If a key is exposed, revoke it and create a replacement. Revocation does not close positions or cancel open orders.

Agents should call a trusted local signing tool. The model should receive sanitized results, not credentials. Do not transmit signed requests to arbitrary hosts, and reject redirects. Keep a non-secret audit record of approved intent, client order ID, time, response code and final execution state.

## Diagnose failures

| Symptom                        | Check                                                                                                                 |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------- |
| Signature rejected             | Uppercase method, exact query encoding/order, identical serialized body, base64url signature, correct secret encoding |
| Wrong account/key              | Derive the public key locally, compare with the supplied API key, and verify account ID and network                   |
| Permission denied              | Required scope is present; `trading` does not imply `read`                                                            |
| Key rejected                   | Expiration, ACTIVE status, and IP restriction settings                                                                |
| Timestamp error                | Milliseconds rather than seconds; synchronized clock and fresh signature                                              |
| Insufficient margin            | Free collateral, fees, pending orders, current positions and requested leverage                                       |
| Minimum/tick error             | Live symbol rules, decimal-safe quantity/price rounding, notional cap                                                 |
| HTTP 429                       | Respect server retry guidance and back off; do not flood requests                                                     |
| Timeout after order submission | Outcome is unknown: reconcile the original client order ID before another write                                       |
| API accepted but no position   | Acceptance is not a fill; inspect final order status and executed quantity                                            |
| Unexpected PnL                 | Unsettled PnL can include prior activity; inspect fills and current nonzero positions                                 |

Check both HTTP status and `success` in the response body. Do not depend solely on error numbers copied from an old guide. Preserve sanitized error codes for diagnosis without logging authentication headers or secret material.

## Before production automation

Test wrong-network handling, invalid signatures, missing scopes, decimal/tick validation, minimum-notional rejection, partial fills, stale prices, request timeout reconciliation, key expiry, and explicit user cancellation. Default to read-only and testnet. Never use cancel-all, withdrawals, or a live market order as an automatic health check.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fluvion.io/api-trading/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.