> For the complete documentation index, see [llms.txt](https://docs.nocktrade.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nocktrade.xyz/concepts/custody.md).

# Custody and keys

The design goal: there must be nothing of yours on our side worth stealing.

## Where your funds live

Your USDC sits in Lighter's rollup contracts, under an account bound to your Ethereum address. NockTrade never takes custody. Withdrawals can only travel to the address that owns the account, and moving funds requires your Ethereum key — which stays in your wallet.

## The trading key

Trading on Lighter uses an API key separate from your Ethereum key. NockTrade handles it like this:

1. When you enable trading, a fresh API key pair is generated inside your browser, in WebAssembly compiled from Lighter's own signer library.
2. The private key is encrypted with AES-GCM. The encryption key is derived from a wallet signature over a fixed message — so only your wallet can unlock it, and the signature itself is never stored.
3. The encrypted key lives in your browser's local storage. It is never transmitted anywhere, and NockTrade has no server that could receive it.
4. The key's public half is registered on your Lighter account with a transaction you authorize with an explicit wallet signature.

Every order is signed locally in your browser and the signed transaction is sent to the venue. NockTrade's infrastructure never sees a private key — there is nothing for us to lose.

## What the trading key can and cannot do

A Lighter API key can place and cancel orders for the account it is registered to. It cannot withdraw to a third party: secure withdrawals only go to the owning Ethereum address, and transfers require the Ethereum key. A compromised browser is still a risk you should take seriously — it could trade your account badly — but it cannot drain funds to an attacker's address.

## Revoking

Registering a new key from another device replaces the old registration for that key slot. Clearing your browser storage removes the local vault; the on-venue registration can be replaced at any time by enabling trading again.

## What NockTrade can never do

* Move, withdraw or redirect your funds.
* Charge fees above the ceiling you signed — see [Fees](/concepts/fees.md).
* See your API private key or your vault signature.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nocktrade.xyz/concepts/custody.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.