ACCOUNTS · CREDENTIALS · RUNTIME
Connection setup
One funded exchange account is sufficient. Add other exchanges when you need their markets. Never paste API secrets into chat.
Exchange accounts and API keys
| Exchange | Server variables | Setup |
|---|---|---|
| Coinbase Advanced | COINBASE_API_KEY + COINBASE_API_SECRET | CDP key name plus private key. Use ECDSA/P-256; preserve PEM newlines. Own spot portfolio; view and trade permissions. |
| Binance Spot | BINANCE_API_KEY + BINANCE_API_SECRET | HMAC API key. Enable reading and spot trading. Use the correct regional Binance service; this connector targets Binance.com. |
| Bybit Spot | BYBIT_API_KEY + BYBIT_API_SECRET | System-generated HMAC key; unified-account spot permissions. Connector targets Bybit.com. |
| XT (connection checks) | XT_API_KEY + XT_API_SECRET | Existing key variables detected. Account and market checks available; automated submission is not enabled for XT. |
Complete each exchange’s identity verification and account confirmations; enable two-factor authentication, restrict the API to your own spot portfolio, enable view/read and spot trading, disable withdrawals, and allowlist the order-executing server’s fixed outbound IP where supported. Region and account eligibility are confirmed by the exchange.
Supabase and deployment
- Dedicated project: EnteleQUANT. URL and publishable-key deployment settings have been configured.
- Add
ENTELEQUANT_SUPABASE_SECRET_KEYfrom that project’s secret API key settings to the server environment. Do not use a publishable key here. - In Supabase Auth, enable email confirmation. Set the site URL to
https://www.entelequant.comand allowhttps://www.entelequant.com/auth/confirm. Configure your authenticated SMTP provider: host, port, username, password, sender address and sender name, plus its delivery domain; add preview callback URLs separately when testing. - The production customer-key vault has been configured with
ENTELEQUANT_CREDENTIAL_ENCRYPTION_KEY: a generated 32-byte key. Preserve this deployment secret; changing it requires re-encrypting stored connections. - Create and confirm your account, sign in, then use the existing operator token to claim the management role. Customer roles cannot enable global trading. Enrol an authenticator and complete MFA before sensitive management, connection and trading actions.
- On an always-on server, run
npm run live:workerwithENTELEQUANT_CONTROL_PLANE_URLandENTELEQUANT_WORKER_SHARED_SECRET. The dashboard requires a fresh heartbeat before starting a live session. Orders execute in the web server runtime, so exchange IP allowlists must match that runtime’s egress, not the driver’s IP. - After account checks, configure
ENTELEQUANT_REAL_MONEY_ENABLED=truefor the production server. The management dashboard must also explicitly enable new entries, and the account owner must authorise each real-money trial. - For subscriptions, add a trusted HTTPS
BASE_RPC_URLsupporting finalized Base blocks. In management, enter monthly/yearly USDC prices and your receiving wallet, then enable billing. Customers pay exact native Base USDC from their own EOA wallet; renewals are manual. - For discovery, configure Google/Bing verification IDs in
ENTELEQUANT_GOOGLE_SITE_VERIFICATIONandENTELEQUANT_BING_SITE_VERIFICATION. Runnpm run seo:submitafter public changes or daily from your scheduler using the worker settings. IndexNow submission does not guarantee indexing or ranking.
Keep real-money execution disabled in preview. Bybit long options require ENTELEQUANT_OPTIONS_ENABLED=true and separate owner consent; short options, leverage, withdrawals, automatic deposits and expiry rollover are not implemented. Fee-discount tokens can require third-currency fee reconciliation; disable that setting for this trial. Budgets, maximum entry amounts, loss triggers and duration are account inputs; exchange minima still apply. Revoke a connection after all its sessions stop, then add replacement credentials. An exchange timeout pauses execution for reconciliation rather than retrying an uncertain order.
Dashboards
Customer accounts see their own connections, sessions, orders and reports. Investor reports use the signed-in account’s records. Management sees runtime configuration and aggregate counts. No customer funds are pooled.