How We Publish Trading Results Without Exposing API Keys
The architecture we use to publish automated PAPER trading metrics while keeping exchange credentials and bot control isolated from the public website.
The problem
A public results page needs fresh trading data, but it should not need exchange credentials, raw production configuration or control access to the trading server.
Our boundary
The trading VPS generates a reduced metrics payload. Only sanitized fields such as closed-trade PnL, counts, drawdown and selected trade metadata leave that environment.
The data path
Trading VPS → sanitized exporter → authenticated HTTPS ingest → public JSON → website. The public site displays the result but cannot place orders or retrieve exchange secrets.
What we deliberately exclude
Exchange API keys, secrets, passwords, raw configuration, position quantities and control endpoints are not part of the public payload. Security improves when the publishing layer has nothing valuable to leak.
How we use this lesson now
We keep experiment versions separate, publish unfavorable PAPER outcomes, record net closed-trade metrics and avoid converting an early result into a profitability claim. The purpose of the record is comparison and diagnosis.