安全與 API 權限Security and API scope

API scopeAPI scope

產品只會要求讀取必要帳戶狀態與執行 Bitfinex funding 操作所需的權限。連線流程會逐項列出 Bitfinex 實際權限名稱；沒有被證明必要的權限不會被要求。

The product requests only the permissions needed to read necessary account state and perform Bitfinex funding operations. The connection flow lists the exact Bitfinex permission names. Any permission not shown to be necessary is not requested.

正式連線畫面會在建立金鑰前顯示完整權限清單，讓使用者逐項核對。The production connection flow displays the complete permission list before a key is created so the user can verify every item.

明確拒絕的權限Rejected permissions

提領權限必須保持關閉。 Alpha Rate 不需要也不應要求將資產提出 Bitfinex 的能力。若偵測到權限超出核准範圍，正式產品應阻止啟用並要求重新建立受限金鑰。

Withdrawal permission must stay off. Alpha Rate does not need and must not request the ability to withdraw assets from Bitfinex. If permissions exceed the approved scope, the production product should block activation and require a new restricted key.

資產留在使用者自己的 Bitfinex 帳戶；Alpha Rate 不成為資產保管人，也不取代 Bitfinex 的帳戶安全措施。

Assets remain in the user’s own Bitfinex account. Alpha Rate does not become the custodian and does not replace Bitfinex account-security controls.

金鑰處理要求Credential handling requirements

正式 API 金鑰只會在完成傳輸與靜態加密、密鑰分離、最小內部存取、秘密遮罩、存取稽核、輪替與安全刪除驗證的產品連線流程中處理。API secret 不得出現在公開頁面、用戶端紀錄、分析事件或一般支援訊息中。

Production API credentials are handled only through a product connection flow verified for encryption in transit and at rest, key separation, least-privileged internal access, secret redaction, access auditing, rotation, and secure deletion. API secrets must never appear on public pages, client logs, analytics events, or ordinary support messages.

公開網站與客服管道不會要求或接收 API key、API secret、密碼或 2FA 碼。The public website and support channels do not request or accept API keys, API secrets, passwords, or 2FA codes.

停止與撤銷Stop and revoke

1. 先從產品控制介面停止自動化，確認不再建立新操作。
2. 在 Bitfinex 帳戶內撤銷或刪除該 API 金鑰；這是最終控制。
3. 獨立檢查 Bitfinex 活動與未完成 funding 狀態，必要時聯絡 Bitfinex。

1. Stop automation from the product control surface and confirm that no new actions are created.
2. Revoke or delete the API key inside Bitfinex. This is the final control.
3. Independently review Bitfinex activity and open funding state; contact Bitfinex when necessary.

撤銷 API 不一定取消已在 Bitfinex 成交或進行中的交易；使用者仍需依 Bitfinex 規則處理帳戶狀態。

Revoking an API key may not cancel transactions already matched or in progress on Bitfinex. The user must still manage account state under Bitfinex rules.

安全營運與事件Security operations and incidents

安全營運包含變更審查、相依套件管理、權限複查、備份復原演練、事件分級、密鑰撤銷程序與使用者通知標準。一般產品聯絡請使用聯絡頁公布的客服管道；敏感安全事件不得附上任何正式憑證。

Security operations include change review, dependency management, permission recertification, backup recovery exercises, incident classification, credential-revocation procedures, and user-notification criteria. Use the support channel published on the contact page, and never attach production credentials to a security report.

使用者應啟用 Bitfinex 2FA、為 API 設定 IP 限制（若支援）、使用獨立金鑰，並定期檢查權限與帳戶活動。

Users should enable Bitfinex 2FA, apply API IP restrictions where supported, use a dedicated key, and regularly review permissions and account activity.