Security
How GoldenClaw protects your data and exchange credentials
GoldenClaw acts as a proxy between your AI assistant and crypto exchanges. Your exchange credentials are stored encrypted and never exposed to AI models.
Data Flow
AI Client → GoldenClaw API (HTTPS) → Exchange API
↓
Encrypted credential
storage (AES-256)What GoldenClaw Receives
| Data | Stored? | Purpose |
|---|---|---|
| API key (GoldenClaw) | Yes | Authenticate your requests |
| Exchange credentials | Yes (encrypted) | Sign and route the orders you authorize to your exchange |
| Request parameters | No (transient) | Forward to exchange API |
| Market data responses | No (transient) | Return to your client |
| Order details | No (transient) | Forward to exchange, not stored |
What GoldenClaw Does NOT Receive
- Your AI conversation history
- Your prompts or system instructions
- Data from other MCP tools connected to your AI client
- Your exchange withdrawal passwords or 2FA codes
Credential Encryption
Exchange API keys and secrets are encrypted at rest using AES-256. Decryption occurs only at request time in memory and is never logged.
No withdrawal access
GoldenClaw cannot withdraw funds from your exchange account. Exchange credentials are used only for order routing and data access. Always configure your exchange API keys with withdrawal disabled.
You Are the Operator
GoldenClaw signs and routes orders using your encrypted exchange credentials. You — not GoldenClaw — decide what orders to send. Configure exchange-side risk limits (max order size, daily loss caps, IP whitelisting) as a defense-in-depth layer.
Scope Isolation
API key scopes restrict what operations are possible:
| Scope | Can Do | Cannot Do |
|---|---|---|
market:read | Fetch prices, OHLCV, tickers | View account, place orders |
indicators:read | Calculate technical indicators | View account, place orders |
account:read | View balances, positions | Place or cancel orders |
trade:futures:write | Place/cancel futures orders | Access other market types |
Create keys with minimum required scopes. A market-data-only integration should never have trading scopes.
Transport Security
- All API traffic uses HTTPS (TLS 1.2+)
- MCP transport uses Streamable HTTP over HTTPS
- No plaintext HTTP endpoints exist
API Key Best Practices
- Keys are shown only once at creation — store immediately
- Revoke compromised keys instantly from your Dashboard
- Use separate keys per application and environment
- Rotate keys periodically
Exchange API Key Best Practices
When creating exchange API keys for use with GoldenClaw:
- Disable withdrawals — GoldenClaw never needs withdrawal permission
- IP whitelist — If your exchange supports it, restrict API key access to specific IPs
- Use sub-accounts — Create a dedicated sub-account for API trading
- Set trading limits — Configure maximum order sizes on the exchange side
Reporting Security Issues
Contact security@goldenclaw.sh for vulnerability reports. Do not disclose security issues publicly.