Documentation

Credential security

Your funds stay in your exchange account. Rebalio uses API credentials to read account information and carry out the exchange operations you authorize. Those credentials are stored in an AES-256-GCM encrypted vault, with access tied to your account and the specific exchange connection.

Choose the right exchange permissions

Create a dedicated API key for Rebalio in your exchange account. Give it only the permissions you need:

• Read access lets Rebalio retrieve balances, prices, and open orders.
• Spot trading access is needed to submit and cancel orders during manual or scheduled rebalancing.
• Keep withdrawals disabled. Rebalio does not need withdrawal permission to manage your allocation.

Use a supported spot account. Margin, borrowing, and futures are not supported. See exchange connections for exchange-specific requirements and IP restriction guidance.

Trading permission still allows changes to your holdings. Review your allocation and schedule carefully, even when withdrawal permission is disabled.

How your API keys are protected

When you connect an exchange, Rebalio validates the credentials and stores them in the encrypted vault. Each stored credential is associated with both your user account and that exchange connection. Rebalio checks that association when retrieving it.

Saved API secrets are not returned to your browser. Exchange operations retrieve credentials on the server when they are needed to synchronize your account or submit, reconcile, and cancel orders. Rebalio does not log credential values or signed request URLs.

Encryption protects stored credentials; it does not make them inaccessible to Rebalio. The service must be able to retrieve them to perform the operations you authorize.

Access to your portfolio

Your connections, portfolios, and trade operations belong to your account. Access checks verify ownership before returning account data or carrying out changes. Another Rebalio user cannot access your portfolio simply by knowing its identifier.

Rebalancing follows the allocation and scheduling settings you choose. A balance refresh updates account information without starting a trade. See data freshness for how synchronization works.

Protect your sign-in

Sign in with Google or email and password. You can add an authenticator in Settings for two-factor authentication. Removing an enrolled authenticator requires a valid code from that authenticator.

Use a unique password if you sign in by email, protect the email or Google account you use for access, and sign out when using a shared device. Never share your exchange API secret or authenticator codes.

Replacing or disconnecting a key

You can replace a connection’s credentials when rotating an API key. Confirm that the replacement belongs to the same exchange account. If validation fails, Rebalio keeps the working credentials rather than replacing them with an invalid key.

When you disconnect, Rebalio first cancels its outstanding orders. If an order’s outcome is uncertain, the connection remains open and credentials remain available for recovery until the outcome is confirmed. Orders placed outside Rebalio are left untouched.

Once disconnection finishes, Rebalio stops using the connection and queues its saved credentials for deletion. Disconnecting does not immediately erase your portfolio history. The separate Delete account action in Exchanges removes the connection and its associated Rebalio data; it does not delete your account or funds at the exchange. Read the connection deletion details.

If you suspect a key has been exposed

Revoke the affected API key directly at your exchange to stop further access through that key. Review open orders and recent activity at the exchange, and secure your sign-in account if necessary.

Revoking a key also prevents Rebalio from using it to reconcile or cancel pending orders, so check those orders directly at the exchange. Create a new dedicated key and replace the saved credentials only when you are ready to reconnect.