# Security

URL: https://docs.fxapis.com/security

> How we protect your broker credentials, your keys and your data.



Connecting an account means trusting us with its password. This page says what
we do with it, and what remains your responsibility.

## Broker passwords [#broker-passwords]

* **Sent once, over TLS**, when you connect the account.
* **Encrypted immediately, with a key unique to that account.** An encrypted
  password cannot be moved onto another account and decrypted there.
* **Never returned** by any endpoint, never shown in the console, and never
  written to a log or an error message.
* **Used only to log the account in** at its broker — or to re-store it when
  you move the account to a corrected server — and every use is recorded in an
  audit trail.
* **Erased when you disconnect the account.** The account's trading history
  stays; the password does not.

Send the **trading** password. An investor password logs in but cannot trade.

## API keys [#api-keys]

* A key is shown once, when it is created, and we never store the key itself —
  nobody, including us, can read it back.
* Keys are **scoped**: give each integration only what it needs, such as
  `trading:reduce` for a risk tool that must be able to close but never open.
* **Live and test keys are labelled** (`fx_live_…`, `fx_test_…`), so each
  configuration is easy to tell apart. Both reach real brokers — test with demo
  accounts.
* Revoking a key takes effect on its **next request**.

Keys are server-to-server credentials. Keep them out of browsers, mobile apps
and source control. See [Authentication](/authentication).

## Signing in to the console [#signing-in-to-the-console]

* The session cookie is moving to a `__Host-` cookie, which only fxapis.com
  itself can set or read, never a subdomain. It is rolling out now; the
  current cookie name is accepted until the change is complete.
* A session lasts seven days and ends after a day unused. The staff console
  asks staff to sign in again every 12 hours and after 30 minutes away.
* Repeated wrong passwords bring a quick human check, then a 15-minute pause
  for the account, with an email to its owner.
* Making a key that can move money or accounts, widening a key to such a scope
  or changing limits on a key that already has them, team changes and plan
  changes ask you to confirm it's you if you have not in the last two hours.
  Staff keep a ten-minute window in the staff console.
* Every sign-in, failed sign-in, sign-out, password change and two-factor
  change is in your workspace's audit log. A sign-in from a browser not seen on
  that network in 30 days is emailed to you.

## Your data [#your-data]

* **Every workspace is isolated.** Another workspace's account, order or key is
  simply *not found* — we do not even confirm that it exists.
* **All traffic between you and fxapis is encrypted**: the API is only
  reachable over HTTPS. Credentials pass between our services over mutual TLS
  on a private network.
* **Everything that changes an account is audited**: connecting, disconnecting,
  every order, every key issued or revoked.
* **Your trading history is kept** for the life of the account, because it is
  what a dispute or an audit is settled with.

## Your part [#your-part]

* **Issue narrow keys and rotate them.** A key with `accounts:write` can
  disconnect accounts; a key with `trading:execute` can open positions.
* **Use a dedicated MT5 account** for automated trading where you can, and
  consider turning on your broker's own protections.
* **Protect your console sign-in.** Members of your workspace can manage its
  keys according to their role. Turn on two-factor sign-in (an authenticator
  app, with backup codes) under Security in the console, and check the list of
  browsers you are signed in on there from time to time.

## Reporting a vulnerability [#reporting-a-vulnerability]

Email **[security@fxapis.com](mailto:security@fxapis.com)**. We acknowledge within one business day. Please do
not disclose publicly until we have had a chance to fix it.