# Sodot Exchange API Vault

:::warning[Use Sodot Crypto Vault instead]
**Sodot Crypto Vault** is the newer, better and expanded product that supersedes the Exchange API Vault and is the recommended way to secure exchange API keys. Head to the [Crypto Vault documentation](https://vault.docs.sodot.dev) to get started.
:::

## Overview

Sodot **Exchange API Vault** delivers best practices for securing and managing your off-chain (CEX) trading API keys.

It allows its users to securely manage their API keys for CEXes, including:

* **Securely import** the API keys from the CEXes UI to a secure storage.
* **Securely store** the API keys in a distributed manner, eliminating a single point of failure.
* **Define policies** for the API keys across CEXes.
* **Securely sign** trading orders or transfers without exposing the API keys to the trading machine.
* **Effective remediation** in risky scenarios, such as freezing all operations with a single button press.

![Exchange API Vault Overview](/img/vault.png)

## Architecture

The Exchange API Vault is built on top of the [**vertex**](/vertex/overview) cluster, which is a distributed key management system that leverages both MPC and secure enclaves (abbr. TEEs) technology to securely store and manage sensitive keys.
A Vertex cluster is deployed in a **three-node cluster** configuration, where each node is a separate instance of a [Vertex](/vertex/overview) service. The nodes communicate with each other using a secure **[relay server](/relay-server/relay_dev_env)**, which allows them to share keys and perform signing operations in a distributed manner.

![Vertex Cluster Architecture](/img/custody.svg)

:::info
More about the cryptography behind the distributed signing process can be found in the [cryptography](/cryptography/hmac) docs.
Our cryptography code was audited by NCC Group (September 2025), Trail of Bits (September 2024) and NCC Group (July 2023).
:::

### API Keys - The New Attack Vector

Crypto trading can be split into two categories: **on-chain** trading using wallets and **off-chain** trading via centralized exchanges (or CEXes).

As on-chain trading uses the wallet's private key to sign transactions, off-chain trading uses API keys to programmatically sign trading/transfer requests for the CEX APIs.

While on-chain private key security has progressed significantly and has received the majority of the focus, attackers move away to off-chain API keys. As many organizations still lack awareness to their sensitivity or lack knowledge of how to safeguard them.

Today, if you're a trading firm or a market maker that uses those CEXes, you have to use API keys insecurely, in one or more of the following ways:

1. **Insecure Import Method** - the API key is copied from the CEX UI and moved into a storage of any kind (e.g. secret manager, database or a spreadsheet)
2. **Programmatic Usage of the Key** - machines (and therefore devs) have to access the API key in order to perform the trading logic.
3. **Remediation & Risk Management** - as companies use multiple CEXes, they’re forced to have granular permissions and policies defined and enforced only on the exchange side, according to the options CEXes offer, which are often limited and fragmented.