Sign inApply for beta

Security

Designed so the worst case stays small.

Your capital stays at your exchange: Kraken Futures, Binance Futures, OKX Perpetuals, Bybit, Bitget Futures or KuCoin Futures. PERP KING does not use withdrawal, deposit, or transfer endpoints. A read-only key is only for viewing. Customer systems run apart from the operator robot.

Architecture

Separation at every boundary.

Your browser talks only to the customer platform. The trading engine is a separate system that the customer platform can read coarse status from — and nothing else.

Protections

What's in place today.

Passwordless sign-in

One-time access links that work once and expire, plus 6-digit email codes where email is enabled. Codes expire in 10 minutes and lock after repeated wrong attempts. No password to phish or reuse.

Hardened sessions

HttpOnly, Secure cookies scoped to the API. CSRF token and same-site origin on every change. Idle expiry; sign out every device.

Encrypted keys

Checked against the exchange before storage, then encrypted (Fernet: AES-128-CBC with HMAC-SHA256). Never displayed again, never exported.

Isolated service

Separate process, storage and encryption context from trading. Staff access needs a separate operator identity with two-factor authentication.

Your activity log

Sign-ins, setting changes, key events and automation actions, with a coarse network hint instead of your full IP.

Abuse resistance

Rate limits, bot traps on forms, and responses that never reveal whether an email has an account.

Exchange keys

The life of your API key.

A read-only key shows your account. A separate trade key can place and cancel orders. LIVE automated execution runs on Kraken Futures, Binance Futures, OKX Perpetuals, Bybit, Bitget Futures and KuCoin Futures. PERP KING does not use withdrawal, deposit, or transfer endpoints and does not require those permissions.

  1. You create it

    A dedicated key at Kraken Futures, Binance Futures, OKX Perpetuals, Bybit, Bitget Futures or KuCoin Futures. Read-only to view the account, or a separate trade key. Leave withdrawal permission off. OKX, Bitget and KuCoin also use a passphrase.

  2. We check the account read

    An account read is checked against that exchange before the key is stored. That check does not prove withdrawal permission.

  3. We encrypt it

    Encrypted at rest under a key used only for customer credentials.

  4. Least privilege

    A read-only key only displays the account. A trade key can place and cancel orders and stops. PERP KING does not use withdrawal, deposit, or transfer endpoints with either key.

  5. You revoke it

    Delete it in the terminal or at the exchange, any time.

Our commitments

  • Never ask for a withdrawal-enabled key, your exchange password or 2FA codes
  • Never hold, pool or move your funds
  • Never call a withdrawal, deposit or transfer endpoint
  • Never sell your data or load third-party advertising trackers
  • Never email a link asking for exchange credentials

Your part

  • Create a dedicated exchange key just for PERP KING, with withdrawals disabled
  • Protect your email with a strong password and two-factor authentication
  • Only sign in at https://perpking.net
  • Revoke the key at the exchange if you stop using PERP KING

Live on your account

How live trading on your account is bounded.

When you start live trading, orders go to your account on the connected exchange. The house engine selects the symbol and direction, and size follows your equity and limits. PERP KING does not use withdrawal, deposit, or transfer endpoints.

Tenant isolation

One isolated executor per account, per-account encryption keys, and no shared state with the operator's own trading.

Least privilege

A separate trade key. You attest that you have not enabled withdrawal or transfer. PERP KING does not verify that switch, and it does not send withdrawal, deposit, or transfer requests.

Your risk envelope

Your limits enforced deterministically before every order, under platform ceilings that can only be stricter.

Idempotent & reconciled

Unique order identifiers, protective stop first, and continuous reconciliation against the exchange.

Controls that always work

Pause, stop and a per-account kill switch that doesn't depend on the strategy.

Full audit

Every intent, order and protection action recorded and visible to the account owner.

No third-party audit yet. PERP KING has not undergone an external security audit or certification, and we don't claim one. Found a vulnerability? Report it privately via the contact page (Security topic). Please don't access other people's data or degrade the service while testing.

Put PERP KING to work — inside your limits.

Free during the private beta, approved individually. No card, no subscription. Your capital stays in your own exchange account.

Apply for the private beta How it trades