API Authorization Agreement
Last updated: May 7, 2026 · TradeShield
This API Authorization Agreement ("Agreement") governs the authorization you grant to TradeShield to interact with your accounts at third-party cryptocurrency exchanges and brokerages ("Exchanges") on your behalf, using API credentials ("API Keys") that you provide. It supplements — and is incorporated by reference into — the TradeShield Terms of Service.
1. What You Authorize
By adding API Keys for an Exchange to TradeShield and enabling any feature that uses them (including, without limitation, Auto-Protect cancellations, automated trading bots, scheduled orders, and risk controls), you irrevocably authorize TradeShield to:
- Use your API Keys, server-side, to call the Exchange's APIs in your name and on your account.
- Read account, order, and market data necessary to compute risk and execute the features you have configured.
- Place, cancel, modify, or query orders on the Exchange in accordance with the parameters and rules you have configured (instrument, side, size, schedule, stop-loss, take-profit, daily caps, drawdown caps, time-based exits, paper or live mode, etc.).
You confirm you have read and understood the Exchange's own terms and the scope of the API Key permissions you are providing.
2. Scope of Authority — What You Do NOT Authorize
- We do not require, request, or accept withdrawal permissions on any API Key. Do not provide an API Key with withdrawal scope.
- We never take custody of your funds, digital assets, fiat, private keys, or seed phrases. All assets remain in your account at the Exchange at all times.
- We do not exercise any discretion over your account beyond the parameters you have set. We are not your broker, dealer, custodian, money transmitter, virtual asset service provider, or investment adviser.
3. Storage and Encryption
API Keys you submit are encrypted at rest using AES-256-GCM with keys held server-side and outside the application database. Keys are decrypted only in memory at the moment they are needed to call the Exchange. They are never returned to the client, never logged, and never shared with third parties.
4. Revocation and Removal
You may revoke your authorization at any time by:
- Deleting the API Key from TradeShield (Settings → Connections), or
- Disabling or rotating the API Key directly at the Exchange.
Revocation at the Exchange is the strongest control and takes effect immediately on the Exchange side. Until revocation is complete, previously-scheduled actions may still be attempted.
5. You Are the Trader
Every order or cancellation placed under this authorization is placed at your direction, on your account, using your API Keys, against parameters you configured. TradeShield acts solely as a software tool that submits the actions you have pre-authorized. You are solely responsible for:
- Compliance with the Exchange's terms of service, KYC/AML obligations, and any applicable law in your jurisdiction.
- Selecting an appropriate API Key permission scope (we recommend trade-only, no withdrawal, and an IP allow-list where available).
- Monitoring open positions, working orders, and Exchange-side alerts, and intervening directly at the Exchange when required.
- All financial outcomes of orders placed under this authorization, including fills, partial fills, missed fills, slippage, fees, funding charges, liquidation, drawdown, and tax consequences.
6. Best-Effort Execution
Calls to Exchanges depend on third-party APIs, network conditions, rate limits, and Exchange-side availability. Authorized actions — including Auto-Protect cancellations, scheduled bot orders, and stop-loss enforcement — are performed on a best-effort basis and may be delayed, rate-limited, rejected, partially filled, or unavailable during outages. See the Bot Risk Disclosures for the non-exhaustive list of failure modes you accept.
7. Limitation of Liability
The limitations of liability and indemnification in the Terms of Service apply in full to all actions taken under this Agreement.