Skip to content

Encryption and verification#

How keys are stored#

When you save an API key, HookTrader:

  1. Takes the secret you typed and the API key string.
  2. Encrypts both using industry-standard encryption.
  3. Stores only the encrypted form. Plaintext never touches disk.
  4. Decrypts only when about to place a trade — never persisted in plain form.

The encryption master key lives on the server and is never logged. Database access controls ensure encrypted credentials are excluded from any read-only reporting access.

The secret is never returned via the API after save. Even an admin reading the database sees only ciphertext.

If you ever need to rotate the key — for example because you suspect it leaked — generate a new one on Binance, revoke the old one, and save the new one in HookTrader (you can overwrite the existing row). Webhooks bound to that key pick up the new credentials on the next call.

Verify permissions#

Every key has a Verify permissions button on its exchange detail page. Pressing it runs a test call to Binance using your credentials and reports:

  • ✅ Verified — credentials work, Futures permission present, IP whitelist (if any) lets us in.
  • ❌ Failed — with the Binance error code and a short explanation.

Verification also runs automatically on save, and periodically in the background, so degraded keys surface in Notifications even if you don't touch them.

You don't need to re-enter the secret to re-verify.

Common verify failures#

Error What it means
-2015 Invalid API-key, IP, or permissions The key is wrong, revoked, or your IP isn't on the whitelist.
-2014 API-key format invalid Typo — usually a trimmed or wrapped paste.
-1022 Invalid signature Wrong API secret saved against this key.
-1003 Too many requests / banned Binance has the IP in temporary cooldown. Try again in a minute or two.

See Troubleshooting → Binance error codes for the full table.

Health badge#

The exchange detail page shows a green / amber / red badge:

  • Green — last verify succeeded.
  • Amber — verify hasn't run recently or the balance display may be slightly delayed.
  • Red — last verify failed, or Binance has us in IP-ban cooldown. The dashboard will resume polling automatically once the cooldown expires.

The status updates automatically in the background — you can always force a fresh check with the Verify permissions button.

Rate-limit cooldown banner#

If Binance temporarily blocks our IP for hitting weight limits, the exchange detail page shows a red banner with a retry countdown. Your credentials are fine — this is transient. Polling resumes automatically.