Your data
API keys, sessions, and keeping them safe
A key is not a password, but treat it like one. How Firmtrack stores it, how to rotate it, and what to do if you think it leaked.
Sources last checked
Good habits
- Create a key per app (name it "Firmtrack") so you can revoke one without touching the others.
- Never paste a key into chat, email, or a support ticket. Firmtrack support will never ask for it.
- If a key leaks, revoke it at the platform first, then paste a new one in Firmtrack. Re-pasting under the same username replaces the stored key in place; your history stays.
What Firmtrack does with it
- Validates it with the platform before storing anything; a wrong key is never saved.
- Seals it with AES-256-GCM under a key that lives only in the server environment.
- Sends it only to the platform's own API host, over TLS, never following a redirect.
- Deletes it when you disconnect.
Sessions instead of keys
Tradovate connections use a session token from Tradovate's sign-in page rather than a key. Sessions expire; Firmtrack renews them while it can, and asks you to sign in again when it cannot. That is a one-click "Connect again", not a lost connection.