Загрузка видео...

Не удалось загрузить видео

На главную

API Permissions Clarified …you control every permission yourself. When creating an API key on your exchange, you decide what SUMEX can or cannot do. …withdrawal permissions are NEVER required. SUMEX does not request - and cannot use, any withdrawal rights. …your keys stay encrypted. We don’t see your API...

22,805 просмотров • 8 месяцев назад •via X (Twitter)

Комментарии: 0

Нет доступных комментариев

Здесь появятся комментарии из оригинального поста

Похожие видео

You can't pretend you care about security if you are still sharing API tokens in .env files or sharing SSH keys. This might be good enough to provide simple access to a resource, but it's a horrible way to do security when it really matters. Look into "Identity-Based Access". The state of the art today is Identity-Based Access. With traditional security, you have to present a key to get access to the resource (an API key, a password, or an SSH key). These are long-lived keys you need to keep secret somehow. If somebody steals your key, they become you and get the same access you had. With Identity-Based Access, you need to prove who you are instead. If you are a human, you can prove this with a passkey, SSO with Google or GitHub, or Multi-Factor Authentication. If you are a computer, you can use AWS IAM, Kubernetes, a cloud service account, or any other trusted environment. Once the system verifies your identity, it checks your permissions and gives you a short-lived credential. Prove identity → Permissions → Short-lived credential → Access The difference here is huge, because those credentials are: • Short-lived • Tied to a specific identity • Scoped to specific permissions • Automatically expired • Much easier to audit In practice, implementing this is as simple as integrating with Teleport, which will handle everything for you. Here is a full explanation of how Teleport works and how you can start using it: Thanks to the Teleport team for partnering with me on this post.

Santiago

20,971 просмотров • 2 месяцев назад

Coming soon on XPR Network 🤖 Trading bots usually want your money or your keys. This one gets neither. The problem: automated trading usually means trusting someone. You hand your funds to a platform, or give a bot your keys and hope. If they get hacked or disappear, so does your money. What we built: trading vaults you own. ⚛️ Your vault is an ordinary XPR account in your name. ⚛️ Our bot can call exactly one action on it, trade, inside limits you set: per trade, per day, and what it must always keep. ⚛️ It can't withdraw or send your funds anywhere. Only you can. Your money never leaves your control. Orders don't sit on the DEX: each trade fills and settles back into your vault in the same transaction. So your funds are always in an account YOU control, and you can take them out any time with one signature, even if our servers are down. That's thanks to XPR Network's permission system: a custom permission, tied by linkauth to that one trade action, is all the bot ever gets. Trustless setup: an on-chain contract builds your vault from published, hash-checked code. Before you add a cent, your browser reads the chain and runs 7 checks: that it's the published code, that only you own it, and that the bot can do exactly one thing. We never hold your funds. Why XPR Network: permissions fine-grained enough to lock a bot to one action, no gas fees so small trades make sense, an on-chain order book (Metal X) with on-chain price oracles, and WebAuth Wallet signing with Face ID or Yubikey. Here's a full setup, start to finish 👇 Opening soon to a small group of testers.

Paul Grey

24,091 просмотров • 1 месяц назад