> For the complete documentation index, see [llms.txt](https://rwaperp-1.gitbook.io/rwaperp-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rwaperp-1.gitbook.io/rwaperp-docs/rwa-perp-b2b-api/authentication/security-and-troubleshooting.md).

# Security and troubleshooting

Secure API credentials and resolve common authentication failures.

### Key scope and lifetime

The default scope used by the onboarding example is `read,trading`. Add `asset` when the key also needs to authorize withdrawals and transfers. The example sets the key expiration to 365 days; bind a new key before the configured expiration time.

### Security

Deploy only the API private key to your trading processes; never deploy the wallet private key. If an API key is exposed, bind a replacement, update the affected processes, and stop using the old credential.

### Common issues

| Symptom                                                            | Resolution                                                                                                       |
| ------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- |
| `address and signature do not match`                               | Use `register_dex_account`; add `chainType: "EVM"` to the body; `chainId` must be `196` (X Layer)                |
| Opened an account / bound a key on Avalanche, Arbitrum, Base, etc. | This environment **supports X Layer only** (`CHAIN_ID=196`); correct it and repeat account opening / key binding |
| `must not be blank` when binding a key                             | Use `dex_api_key` + `AddDexApiKey`; the public-key field is **`key`**                                            |
| `nonce is invalid`                                                 | Take the account-opening `timestamp` from the server time in the `registration_nonce` response                   |
| `401` on REST                                                      | Check that the account\_id and key belong to the same account, and that the path/body match what was signed      |
| `Verify contract is invalid` on withdrawal                         | Do not use the account-opening `0xCcCC` address or a vault address; see Withdrawals                              |
| Public WS disconnects immediately after connecting                 | Use the `account_id` returned by `GET /v1/get_account`; arbitrary session identifiers are not accepted           |
| `401` on private WS                                                | `rwa_sign` signs the timestamp only; do not apply the REST signing rule                                          |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://rwaperp-1.gitbook.io/rwaperp-docs/rwa-perp-b2b-api/authentication/security-and-troubleshooting.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.