Keys and signing
The keys on a trading account, the signer frame that holds the trading key, and the wallet bridge that carries owner calls.
Three kinds of key can act on a trading account. Your owner wallet’s key stays in your wallet and is used for owner calls. The trading keys live in the signer frame in your browser and sign trades. The 24/7 key, if you turn 24/7 orders on, sits with our order service and can only send orders you stored. This page covers the trading keys, the frame that holds them and the wallet bridge that carries owner calls.
The terminal page itself holds no key. It asks the frame for every signature, and the frame decides.
The signer frame
Section titled “The signer frame”The frame is a separate site, embedded in the terminal. Because it’s another origin, script on the terminal page can’t read its storage, call its functions or click its buttons.
The key itself
Section titled “The key itself”The frame creates each key pair with WebCrypto as a key the browser won’t export, so even the frame’s own code can only sign with it. One device trades at a time: setting up a new device adds its keys and removes the other device’s keys in the same owner signature.
Locked and unlocked
Section titled “Locked and unlocked”The frame, not the terminal, owns the session. It refuses to sign while locked. Only a real click on a button the frame draws itself unlocks it, and script on the terminal page can’t produce that click. The session then stays open until you choose Lock trading or close the browser.
What the frame checks
Section titled “What the frame checks”The frame checks every request against its own rules before it signs, and refuses anything else. The contract runs its own checks again on whatever the frame signs.
When the frame says no
Section titled “When the frame says no”A refusal comes back to the terminal as a code, and the terminal puts the common ones in plain words: a locked frame reads “Trading is locked. Unlock to continue.”, a frame that doesn’t answer reads “The signer didn’t answer. Reload the page.”, and an unlock prompt you closed reads “Unlock cancelled.” Any other code is shown with the frame’s own message. In each case nothing was signed, so nothing reached NEAR and nothing needs undoing.
Owner calls go through the wallet bridge
Section titled “Owner calls go through the wallet bridge”Owner calls need your wallet’s own key. The terminal hands them to the wallet bridge, another separate origin that connects your wallet. Before it passes a transaction to the wallet, the bridge checks it against its own rules. Your wallet then shows you the transaction to approve. The bridge doesn’t see your wallet’s key; your wallet signs.
A key’s life
Section titled “A key’s life”A key you forget in the frame stays on the account until the owner wallet removes it; a key the owner wallet removes can’t sign again even if a browser still holds it. Losing a device is covered in Risks.
Replacing this browser’s keys
Section titled “Replacing this browser’s keys”Settings lists every key on the account, read from the chain, and offers Rotate on this browser’s trading key. One owner signature adds the new keys and deletes this browser’s old ones in a single transaction. If the wallet step fails, the screen says “Not rotated. Your current key still works.” and the old keys stay as they were.
Sources
Last verified 15 October 2026 against R4.