Crypto Signal Account Access: 16-Provider API and Automation Audit

The cohort map describes route identity before judging controls

The posture is a route classification, not a conclusion about security or conduct. The two native-platform records have a closer product relationship to exchange APIs, but the public dossier still cannot establish the exact key attached to any individual account. The four third-party or copy-offer records make the intermediary or exchange-native route more explicit, while leaving connection-specific permissions and incident handling to be checked. The four unresolved records show why historical automation language cannot be silently upgraded into a current product claim.

The deposit or identifier-gate posture deserves its own state because commercial access and execution access are different. A subscriber may be asked to use a referral link, fund an exchange, or submit a UID to qualify for a channel. Those steps can create commercial attribution or eligibility without giving the signal provider an API credential. Conversely, a product can ask for an API key without requiring the same deposit flow. Combining both into one automation label would hide the party receiving authority and the action the user actually takes.

The alphabetical matrix keeps route, risk, proof, and safest action together

Each provider appears once and is sorted by display name, never by source count, automation depth, commercial status, or editorial posture. Platform and product names are copied from the frozen provider object. The access posture comes from the explicit provider-specific taxonomy in this generator. The risk and missing-proof bullets preserve exact strings selected from the frozen arrays, and the safest-action text is also preserved exactly. This combination is intentionally more useful than a yes-or-no automation badge: it shows what route was described, which control concerns were already authored, what evidence could change the record, and what action the dossier advised while uncertainty remained.

The labels do not infer capability from a keyword. A record containing “API” in a caution field is not automatically classified as a native API platform. A Cornix reference does not by itself establish a current connection, and an exchange referral does not by itself show order authority. Provider-specific coding was necessary because the same word can describe a product, a historical incident, a missing document, an affiliate condition, or a safety boundary. The matrix makes that coding inspectable without converting it into a ranking.

The source number is the count of assignments attached to the whole provider record. It is not a count of sources independently confirming API permissions, Cornix behavior, copy settings, credential storage, or the safest action. The schema does not map each selected sentence to stable source IDs. One packet can mix primary product pages, terms, historical material, registries, and independent boundary sources that answer different questions. Ten assignments must not be translated into ten confirmations.

Dossier links open the broader evidence files, where identity, pricing, route, risk, and result questions remain visible. The matrix does not recommend connecting any account and does not treat a shorter proof queue as stronger security. A selected list is a focused account-access slice of the full authored queue; unselected items remain unresolved unless the underlying dossier says otherwise. The correct use is to identify the next control question for a particular route, not to select a provider from the posture name alone.

Account access is a control chain, not a single automation switch

A signal can move from publisher to subscriber in several ways. The subscriber can read it and enter an order manually. A bot can parse the message and create an order through an API. A third-party platform can receive the signal and manage the trade. An exchange can copy a lead trader inside its own account system. A provider can require a referral, deposit, or UID only to establish eligibility. Those routes transfer different information and authority even when marketing describes all of them as convenient automation.

A useful audit follows the chain from signal origin to execution venue. Who creates the instruction? Which platform receives it? Which account is linked? What credential or identifier crosses the boundary? Which actions can the connection perform? Who can change strategy settings? Where are keys stored? What happens when a key expires, an exchange rejects an order, the bot loses connectivity, or the subscriber wants to leave? A product page that answers only “automatic” leaves most of this chain unproved.

The frozen records cannot answer every private implementation question, so the posture system stops at what the dossier supports. It does not infer that a named intermediary received a particular subscriber’s credential, and it does not assume that a current product inherits controls from a historical route. This restraint matters because operational authority can change without a public brand change: an integration can be replaced, a permission model can be revised, or a signal channel can move to a different platform while old pages remain discoverable.

A signal instruction and authority to execute it are separate objects

A manual signal communicates proposed market, direction, entry, target, stop, or risk information. The subscriber retains the final act of creating the order. That does not eliminate investment risk or prove the signal is timely, but it keeps exchange credentials outside the signal route. Automated execution adds another layer: software interprets the instruction and uses account authority to act. The subscriber may still configure size, leverage, allowed pairs, limits, or confirmation rules, yet some operational decision has moved to code or another party.

This distinction prevents two opposite errors. The first is assuming every signal group can trade an account merely because it discusses bots or exchanges. The second is assuming automation is passive because the provider says it never withdraws funds. Trade permission can materially alter positions even when withdrawal permission is disabled. A bot that can open, close, cancel, or amend orders can create losses, fees, liquidation exposure, tax records, and conflicts with orders placed elsewhere. Withdrawal prohibition is an important boundary, not a complete description of authority.

Execution authority is also narrower than legal authorization. This audit uses the term operationally: the route can reportedly place or manage orders. It does not decide whether the provider is an adviser, broker, fiduciary, agent, controller, processor, or regulated entity in any jurisdiction. Those legal classifications require facts and law outside this fixed dataset. Likewise, a subscriber clicking an authorization button does not show that the choice was suitable, informed, reversible in practice, or limited according to least privilege.

Read, trade, transfer, and withdrawal permissions answer different questions

Exchange APIs commonly separate categories of access, but labels and defaults vary by venue, product, account type, and integration. Read access may expose balances, positions, order history, or user data. Trade access can place and cancel orders. Transfer-related permissions can move assets between internal account areas. Withdrawal access can send assets away from the exchange. A responsible assessment must inspect the exact exchange screen and current documentation for the specific key, not rely on a generic statement that an integration uses “API access.”

Official Binance documentation, for example, distinguishes request security types and states that an API key has no trading permission by default until enabled. That is useful general context, but it does not establish the settings of any provider-linked account in this cohort. Other exchanges can use different terms, scopes, subaccount models, IP controls, or key-creation flows. Even on one exchange, spot, margin, futures, options, and account-data endpoints may require different permissions. A screenshot from another user’s setup is not proof of the reader’s key.

Least privilege means granting only the access necessary for the intended function. For signal automation, that usually starts by asking whether read access is necessary, whether trading can be restricted to a subaccount, whether transfers and withdrawals can remain disabled, whether IP restrictions are supported, and whether per-key labels and creation dates are visible. Least privilege is a design principle, not a claim that any configuration is risk free. A trade-only key can still create material exposure, and a read-only key can still disclose sensitive account information.

Key custody is a separate control. The exchange can define permissions while another service stores the key or connection token. Evidence should identify whether a manual API secret is entered, whether an exchange-hosted quick-connect flow is used, which organization operates the receiving service, how secrets are encrypted, what staff or systems can access them, how logs are sanitized, how backups are handled, and what deletion means. Public claims such as “secure” or “encrypted” are starting points; architecture, retention, access logging, independent assessment, and incident response make them testable.

Native API automation and exchange copy trading create different trust paths

A native automation platform typically asks the user to connect an exchange account to software that creates or manages orders. The platform may offer bots, signal integrations, portfolio tools, or strategy rules. The trust path runs through the exchange, the automation operator, its infrastructure, and any signal source or strategy module. Configuration matters because the same platform can support observation, manual confirmation, rule-based trading, or fully automated action. A platform-level feature list does not show which mode a particular provider or subscriber selected.

Exchange-native copy trading can avoid handing an API secret to an outside service, but it does not eliminate delegated execution. The exchange associates a follower account with a lead trader or strategy and reproduces eligible actions under platform rules. The user still needs to understand allocation, leverage, maximum loss controls, slippage, symbol eligibility, divergence between lead and follower fills, stopping behavior, fees, jurisdictional availability, and what happens when the lead trader changes strategy. The authority is mediated by the exchange rather than removed.

Third-party automation sits between these models. A signal provider may invite clients to a management platform, publish to an automation channel, or support a bot that connects separately to the subscriber’s exchange. The provider may control signals while the intermediary controls execution infrastructure and credential storage. Support responsibilities can split three ways: the provider explains the strategy, the intermediary handles the connection, and the exchange handles permissions and fills. When an order behaves unexpectedly, the user needs records from all three layers to determine whether the cause was the signal, parser, configuration, API response, exchange rule, or market condition.

These routes should not be ranked solely by the number of parties. An exchange-hosted feature can still be misconfigured; a third-party service can implement strong controls; a native platform can offer granular restrictions; and manual execution can introduce delay or transcription errors. The audit’s job is to expose the authority chain and missing evidence. The user’s task is to decide whether the route’s purpose, controls, and failure modes are acceptable before connecting a funded account.

Cornix references need route-specific control evidence

Cornix appears in the offer fields of 7 of the 16 frozen records. That count is descriptive: it shows literal presence in platform or product fields, not seven tested connections. A Cornix reference can describe automatic trading, an invite flow, an optional integration, a historical service, or a product boundary. The matrix posture and exact selected evidence remain authoritative for each provider because a keyword cannot decide whether the route was current, attributable, or configured safely.

Current Cornix help material illustrates why route details matter. Its secure client-invite documentation describes a flow in which a manager can receive authority to execute trades while the client retains control of funds, and it distinguishes read and write access. The documentation also tells clients they can revoke the API key at the exchange. Its exchange-connection guidance describes both quick-connect and manual API approaches, account types, and exchange-specific requirements. These are official descriptions of Cornix features, not proof that every provider in this cohort used the same flow or settings.

A provider-specific record would ideally identify the exact invitation route, account role, supported exchange, spot or derivatives scope, read and write settings, ability to alter risk parameters, and party responsible for the connection. It would show whether the subscriber can review permissions before acceptance, whether the manager can see balances or history, whether a subaccount is supported, and whether disconnecting inside Cornix also disables the exchange key. It would also disclose any provider, affiliate, or manager relationship relevant to the invitation.

Revocation should be tested as an operational workflow, not left as a sentence in documentation. The subscriber should know how to disable the key at the exchange, how to remove the integration from the intermediary, how to stop copied or automated strategies, and how to confirm that no open orders or positions remain unmanaged. A key can be revoked while a position stays open. A channel subscription can be canceled while an exchange connection remains active. A provider can remove access while the user still needs transaction records. Those are separate lifecycle events.

A deposit, referral, invite, or UID gate is not the same as an execution connection

Five of the 16 offer-field records contain referral, affiliate, or invite wording under the audit’s literal test, and one contains UID wording. These fields describe how a user reaches or qualifies for an offer; they do not by themselves prove that the provider can create an order. A referral link may attribute a new exchange customer. A UID may let a provider or exchange associate an existing account with a campaign or eligibility rule. A minimum deposit may unlock access to a channel. None of those actions necessarily transfers an API key.

The distinction is important because each gate creates a different evidence request. For a referral, the reader needs the receiving exchange, affiliate relationship, geographic eligibility, required trading or deposit conditions, and whether the provider earns revenue from activity. For a UID, the reader needs to know what information the identifier exposes, how it is validated, who stores it, and what happens if it is submitted to the wrong party. For a deposit condition, the reader needs the amount, asset, custody location, lockup or turnover requirement, withdrawal constraints, and refund or access consequences.

Commercial dependence can still affect incentives even without account control. A provider compensated by exchange referrals may benefit when subscribers create accounts, deposit, or trade. That fact would not prove that any recommendation is improper, but it belongs in an evidence file because it helps the reader understand the route. The same separation applies in reverse: an API automation product may charge a subscription without requiring an affiliate deposit. Conflating the business model with the permission model makes both harder to evaluate.

A cautious route check therefore asks two parallel questions. First, what must the user pay, deposit, register, or disclose to receive the service? Second, what technical authority, if any, must the user grant for the service to act? The answers can overlap, but they should be documented independently. This audit keeps deposit-or-identifier gates in their own posture precisely because “exchange connected” can otherwise be misread as “provider can trade the account.”

Historical incidents and same-name products cannot establish a current control state

Three records fall into the no-attributable-current-execution-product posture, and four more retain an automation reference while current controls or attribution remain unresolved. These states reflect a recurring research problem: a search result, archived page, old bot, app listing, or same-name project can demonstrate that automation language existed without proving that today’s provider operates the same route. Names are not stable identifiers. Domains change owners, channels change administrators, products close, integrations migrate, and historical articles can outlive the service they describe.

Historical evidence remains useful when it is labeled. It can establish what was claimed at a certain time, reveal an earlier integration, or identify controls that a new route should address. It cannot be silently merged with a current product page to create one continuous system. Continuity needs explicit cross-links, operator identity, domain history, official migration notices, matching support routes, or another reliable chain connecting the old and new surfaces. Without that chain, a historical API incident should not be attributed to a current same-name channel, and current marketing should not inherit old control assurances.

Incident evidence also needs scope. A compromised user key, provider account takeover, exchange outage, parser bug, malicious strategy, credential leak, and withdrawal event are different failure classes. The date, affected component, permission scope, number of users, detection method, containment, key rotation, user notice, and corrective action matter. An unattributed anecdote cannot support a provider conclusion. Conversely, a transparent incident report is not proof that no residual risk exists; it is evidence that can be evaluated for completeness and remediation.

The safest record keeps time explicit: current product evidence, historical context, and unresolved attribution should occupy separate fields. That prevents search engines and AI systems from combining snippets across dates into a false present-tense statement. It also gives a provider a clear correction path: supply a current official route, operator link, permission description, and incident-control evidence, and the posture can be reconsidered in a later dated audit rather than rewritten retroactively.

No account connection found is a dated observation, not a permanent safety claim

One record is coded as observation-only because the reviewed current surface exposed signals or analysis without payment, custody, or exchange API-key access. That is a useful finding for the snapshot. It narrows what the researcher observed and prevents unsupported automation language from being attached to the provider. It does not prove that no private tier, regional route, later release, partner tool, or separate account connection exists. Negative findings need a defined search surface and date.

The same caution applies to “manual only.” A signal delivered in text can be manually entered by one subscriber and parsed by independent software used by another. Unless the provider supplies or endorses that software, the third-party parser should not automatically become a provider product. But its existence means the delivery format alone cannot prove how every subscriber executes. The audit therefore uses “observation-only surface; no account connection found” rather than a broad claim about all possible use.

For a reader who wants to keep account authority local, an observation-only route can reduce one category of credential exposure, but other risks remain: false identity, delayed messages, phishing links, payment disputes, inaccurate signals, leverage, and manual-entry mistakes. Avoiding an API connection does not validate the publisher or the trade. It only changes the control boundary. The broader dossier and separate commercial, operator, and performance audits remain necessary.

For a provider or platform seeking to document an observation-only posture, useful evidence includes a current official product map, explicit statement that no exchange credentials are requested, list of any optional integrations, clear distinction between official and community tools, and a security warning against impersonators asking for keys. That evidence should be dated and tied to the exact route. If automation is later added, the change should create a new review state rather than relying on the older no-connection observation.

Offer language and caution language tell different stories

The audit runs the same literal, case-insensitive language families against two separate text groups. Offer fields contain the frozen platform plus product names, prices, and billing descriptions. Caution fields contain every authored risk, every missing-proof request, and the safest-action text. Separating them avoids treating a word in a risk warning as evidence that the provider offers the capability. It also shows when a control question appears much more often in due-diligence text than in the product description.

Automation-family wording appears in offer fields for 9 of 16 providers. Cornix appears in 7. Exact copy-trading wording appears in 1. API wording appears in 5, permission wording in 2, exchange wording in 6, referral or affiliate or invite wording in 5, and UID wording in 1. In caution fields, API appears for 13 providers, permissions for 14, and exchange for 14.

These categories overlap. One provider can match API, exchange, automation, and invite, while another relevant route may use wording outside every pattern. Presence does not show prominence, current availability, implementation quality, or truth. Absence does not prove the concept is irrelevant. The fixed counts are useful because they can be reproduced from committed fields; they are not a capability score, allegation rate, security grade, or estimate of the broader crypto-signal market.

The gap between offer and caution fields is itself an evidence-design lesson. Product copy tends to name convenience and connectivity. Due-diligence text asks about keys, permissions, custody, attribution, jurisdiction, incidents, and revocation. Both are necessary, but they answer different questions. Search summaries and AI answers should not quote a caution-field API count as if 13 providers offer APIs, and they should not quote an offer-field Cornix count as if seven live connections were independently tested.

Forty-two selected risks and 35 proof requests define the unresolved control surface

The provider-specific taxonomy selects 42 exact risk strings and 35 exact missing-proof strings across all 16 providers. Those selections preserve the authored wording and zero-based indexes. They narrow the full queues of 83 risks and 98 proof requests to account access, execution authority, route identity, permissions, exchange eligibility, payments, and recovery. The median frozen dossier contains 5 risks and 6 missing-proof requests before selection.

The theme counts overlap and are not exhaustive. A sentence about an exchange-linked account can match permission, eligibility, and route concepts. Another relevant sentence can avoid every listed token. The authoritative evidence is the exact text in the provider matrix and machine-readable files, not the lexical theme total. No selected risk proves that an incident occurred, and no missing-proof request proves that a provider withheld evidence deliberately. Each item states a due-diligence boundary in the frozen record.

A control packet capable of changing the record would identify the current operator and official route; enumerate supported exchanges and account types; show the exact permission request before connection; document whether read, trade, transfer, and withdrawal actions are enabled; explain key creation, encryption, retention, staff access, logs, backup, deletion, and rotation; state whether IP restrictions or subaccounts are supported; preserve manager or bot configuration; and publish revocation and emergency-stop procedures. Where an invite, affiliate, deposit, or UID gate exists, it would also disclose eligibility, commercial relationships, data handling, and exit conditions.

Incident handling belongs in that packet before an incident occurs. Users need a reporting channel, severity process, key-rotation instruction, exchange-contact path, notification policy, evidence-preservation method, and a way to distinguish a provider compromise from an exchange, intermediary, or user-device problem. A promise to help is not the same as a tested procedure. The proof request is therefore about operational specificity, not about assuming a breach.

A beginner and an advanced user need the same boundary at different depth

Beginner route: identify the action before following setup instructions

A beginner should first translate the offer into a plain action: read a message, pay for access, register through a link, deposit at an exchange, submit a UID, connect an exchange, accept a manager invite, or follow a lead trader. If the action is unclear, setup should stop. Screens that ask for API credentials, remote access, seed phrases, private keys, withdrawals, or transfers deserve particular scrutiny. A legitimate-looking brand page does not make an unexpected permission safe.

Next, identify every party in the route. The signal publisher, payment merchant, exchange, automation platform, Telegram or Discord account, affiliate, and support desk may be different entities. Open official documentation independently rather than through a forwarded message. Confirm domains and handles from multiple official surfaces. Read the permission screen before approving it. Do not assume that a provider support account is also authorized to troubleshoot an exchange connection.

Use a separate exchange subaccount when the venue and integration support it, keep permissions to the minimum necessary, disable withdrawals and transfers unless a clearly understood function requires them, and avoid connecting capital that cannot be lost. Those steps reduce some exposure but do not make the strategy profitable or the connection secure. The CFTC’s investor guidance on AI trading bots is relevant here: automation does not turn market prediction into guaranteed or unusually reliable returns.

Finally, record the exit before entry. Save the connection name, creation date, permissions, exchange account, intermediary, provider route, and steps needed to stop automation. Know how to revoke the key directly at the exchange. Check for open orders and positions before and after disconnecting. If the only cancellation instruction is “message an admin,” the user does not yet have an independent control path.

Advanced route: model authority, blast radius, and evidence retention

An advanced assessment should map subjects, credentials, assets, actions, and trust boundaries. Subjects include the subscriber, provider staff, bot service, exchange, cloud systems, and support agents. Credentials include API keys, OAuth or quick-connect tokens, session cookies, Telegram or Discord accounts, email recovery, device keys, and UIDs. Assets include balances, positions, order history, strategy settings, personal data, and logs. Actions include read, create, cancel, amend, transfer, withdraw, invite, impersonate, and revoke.

For each action, document the enforcing system and the residual failure mode. IP allowlisting can reduce unauthorized source locations but may concentrate trust in the intermediary’s infrastructure. Subaccounts can limit balances but may still share identity and reporting. Position limits can constrain order size but fail if leverage or concurrent bots are misconfigured. Emergency stops can halt new orders while leaving open positions. Encryption at rest can protect stored secrets while application-layer compromise still exposes decrypted credentials. Controls need threat-specific interpretation.

Evidence retention should make the execution path reconstructable without exposing secrets. Preserve key identifiers or labels, permission snapshots, account and subaccount IDs in redacted form, strategy versions, configuration exports, signal IDs, intermediary logs, exchange API responses, order IDs, timestamps, and revocation events. Hash or sign exports where practical. Separate audit logs from application logs and restrict access. A support screenshot is useful, but a stable, timestamped event chain is stronger.

Advanced users should also consider interaction effects. Two bots can manage the same position, a manual trade can be interpreted as bot inventory, or a copied strategy can conflict with exchange-level risk controls. Clock drift, rate limits, symbol changes, maintenance, partial fills, and network retries can duplicate or miss actions. The access audit does not test those execution mechanics, but it identifies whether enough route and permission evidence exists to justify a deeper operational test.

Canceling a subscription, stopping a strategy, and revoking a key are separate exits

Commercial cancellation ends or changes a billing relationship. Product access removal changes whether the user can see a channel, dashboard, or strategy. Strategy stop changes whether new automated instructions should be sent. Intermediary disconnection removes a route inside the bot or copy platform. Exchange-key revocation invalidates the credential at the system that ultimately enforces it. Position closure and order cancellation change market exposure. Account deletion changes stored data. None of these events automatically proves the others occurred.

A complete exit runbook puts them in a deliberate sequence. First identify open positions, orders, conditional orders, and strategies so stopping automation does not leave unmanaged exposure. Stop new instructions and confirm the state. Revoke or delete the connection at the exchange, not only in the third-party dashboard. Remove the intermediary association. Verify that subsequent API calls fail or the exchange reports the key inactive. Then address commercial cancellation, data export, deletion, and any retained records needed for tax or dispute purposes.

Emergency response may require a different sequence. If credential exposure is suspected, revoke the exchange key immediately and secure the exchange account, email, two-factor authentication, and recovery methods. Then capture enough non-secret evidence to investigate. Do not wait for provider support before disabling authority the user controls. If unauthorized orders exist, contact the exchange through its official route and preserve order IDs and timestamps. This is general control guidance, not a claim that any provider in the cohort suffered an incident.

Periodic review matters because permissions drift. A key created for one feature can remain active after the feature is abandoned. An exchange may add scopes, an intermediary may change its connection method, or a provider may move strategies. Review connected applications, API keys, subaccounts, copy relationships, device sessions, and withdrawal controls on a schedule. Remove unused access. The safest stale credential is one that no longer exists.

The source packet has 152 assignments, while 102 lack a resolved publication date

The frozen cohort contains 152 provider-level source assignments resolving to 148 unique URLs across 42 hostnames. Each provider has between 7 and 10 assignments, with a median of 10. All 152 assignments carry the common access date 2026-07-10. Access date records when the research checked a route; it is not the publication date and does not show whether content changed before or after capture.

The 102 unresolved publication-date assignments are a freshness limitation, not a judgment about reliability. Some live pages do not expose a publication date, some records store null or blank, and some explicitly remain unresolved. The audit keeps those states visible rather than replacing them with access dates or inferred dates.

Record-level provenance prevents sentence-level control claims

The frozen research schema attaches sources to the provider record. It does not provide stable source IDs or direct references from each risk, missingProof, platform, product, or safest-action sentence to one or more source rows. This generator can prove that the exact authored fields and source packet coexisted in a committed dossier. It cannot prove a one-to-one citation for every sentence, classify all 152 assignments as independent corroboration, or tell a reuser which single URL establishes each permission or route clause.

That record-level provenance limitation is preserved in the JSON summary, CSV boundary, Dataset description, LLMS text, and this article. A record with many sources is not awarded a stronger access posture because of count alone. Source types describe research roles, not votes. Primary material can establish what a provider or platform published; independent-boundary material can constrain interpretation; historical material can establish a past state; registry material can answer identity or domain questions. None automatically reveals a private API key, current permission screen, credential vault, manager configuration, or revocation test.

Readers and AI systems should therefore cite the canonical audit for the aggregate finding and the linked dossier for broader provider context, while preserving the cohort date and limitation. They should not detach one risk bullet and attribute it to every URL in the packet. A future schema with stable source IDs and field-level references could support narrower citations. This release does not pretend that granularity already exists.

The generator reproduces a frozen account-access aggregation, not a live security test

The generator requires a named Git ref, resolves it to a commit, and reads the four Best21 JSON blobs only through git show. It validates schema version, research date, provider count, unique slugs, platform and product fields, exact risk and missing-proof arrays, safest actions, source URLs, source types, access dates, publication-date formats, and complete taxonomy coverage. It does not read mutable working-tree copies of the Best21 files. Provider rows are sorted alphabetically.

The account-access taxonomy is explicit and provider specific. It assigns one of six mutually exclusive postures and zero-based indexes selecting account-access strings from each frozen risks and missingProof array. The generator preserves those strings without rewriting them. Offer-language tests run only against platform and product fields; caution-language tests run only against risks, missing proof, and safest action. Control themes run against selected exact text. These regular expressions are reproducible lexical measures, not semantic adjudication.

Generation asserts the frozen totals before writing: 16 providers; 152 source assignments; 148 unique URLs; 42 hosts; 42 selected risks; 35 selected proof requests; posture counts of 2, 4, 4, 2, 3, and 1 in the documented order; offer-field counts of 9 automation-family, 7 Cornix, 1 copy-trading, 5 API, 2 permission, 6 exchange, 5 referral/affiliate/invite, and 1 UID; caution-field counts of 13 API, 14 permission, and 14 exchange; and 102 source assignments without a resolved publication date. It also requires one Article, one Dataset, one BreadcrumbList, zero FAQPage, one H1, one literal primary action, 16 dossier links, 16 provider rows, the immediate decision boundary, every selected exact string, and at least 4,500 visible words.

node tools/generate-crypto-signal-api-automation-access-audit.mjs --git-ref 5dcd30b2b1a0da9bacbaeec08244190dae19a49f --distribution-ref f89e790bd537f3a3f723f6d2e8f8533fc9ab8b22 --distribution-json-url https://gist.githubusercontent.com/TheCryptoSimon/32ad4048d910521d5a68cc0d5f66c4de/raw/c5e4fd608929039ddf9df278920e4430deb57326/summary.json --distribution-csv-url https://gist.githubusercontent.com/TheCryptoSimon/32ad4048d910521d5a68cc0d5f66c4de/raw/d0649fb987b1ff557bf46799e9d7b9d2e5c2cebf/summary.csv --distribution-version 12d1850f50f34ec53b0becd6f3875e3cf38df1fc --distribution-page-url https://gist.github.com/TheCryptoSimon/32ad4048d910521d5a68cc0d5f66c4de --published-at 2026-07-11 --modified-at 2026-07-11

Reproduction shows that the aggregate matches committed CSR research objects and this fixed taxonomy. It does not log in to providers or exchanges, create credentials, connect funded accounts, inspect private configurations, execute trades, test incident response, or establish later changes. Any current connection decision requires fresh route-specific verification.

The aggregate release preserves capability states without certifying control

The machine-readable release contains the exact aggregate metrics and alphabetical provider matrix used here. It preserves platform wording, selected access-risk text, selected control-proof requests, and safest-action text, but it does not reproduce third-party pages, credentials, private records, ratings, setup instructions, or security conclusions. Any reused count should retain the 16-provider denominator, cohort date, frozen source commit, and record-level provenance limitation.

Release state: The public distribution arguments pin the release page, version, JSON, CSV, and matching repository commit so later site changes do not silently redefine this dataset.

• Download aggregate JSON

  53,201 bytes; SHA-256 3db6df4836f9d4043f8d00d64a0488f14f667d66abf91545c9aec07d79cf1639.

• Download aggregate CSV

  24,343 bytes; SHA-256 6dae709285caaaf4f89f71e079ad8529f34bf3ff95d7e0fc07cd3e37b290d74d.

CryptoSignalsReview Evidence Desk. Crypto Signal Account Access: 16-Provider API and Automation Audit. Cohort captured 2026-07-10. Frozen source commit 5dcd30b2b1a0da9bacbaeec08244190dae19a49f. https://cryptosignalsreview.com/crypto-signal-api-automation-access-audit/

Public release 12d1850f50f34ec53b0becd6f3875e3cf38df1fc; matching repository release commit f89e790bd537f3a3f723f6d2e8f8533fc9ab8b22.

Aggregate reuse terms: CryptoSignalsReview permits quotation and reuse of the aggregate JSON and CSV with attribution to the Evidence Desk, canonical page, 2026-07-10 cohort date, and frozen source commit. Reuse must preserve the non-representative, non-ranking, non-endorsement, non-verification, non-accusation, non-security-certification, and non-performance boundaries. This permission does not grant rights in third-party names, marks, source material, or personal data.

Official guidance defines general controls, not conclusions about this cohort

The following official sources provide current general context for API request permissions, Cornix client invitations and exchange connections, least privilege, and automated-trading claims. They were used to frame control questions, not to rate, rank, accuse, endorse, or validate any provider in the matrix. Binance documentation does not prove the state of a key at another exchange. Cornix documentation does not prove that a named provider used a particular invite or permission configuration. NIST guidance does not certify a commercial platform. CFTC investor education does not determine the truth of a provider statement.

• Binance developer documentation: request security and permissions

  Official exchange context for separating trade permission from user-data access and treating API keys and secrets as sensitive credentials.

• Cornix: secure client invite and revocation

  Official Cornix context for manager execution authority, read or write access, exchange connection, and revoking an API key at the exchange.

• Cornix: connecting an exchange account

  Official Cornix context for account types, Quick Connect or manual API credentials, and the need for exchange-specific permissions.

• CFTC: AI trading bots are not money machines

  Official investor-education context for separating automated execution capability from guaranteed or predictable returns.

• NIST: least privilege

  General security context for limiting a process to the access necessary for its task; it does not assess any provider or exchange connection.

Related evidence answers questions this access audit cannot

• Open the 21 provider evidence files

  The source cohort and narrative overrides cover broader identity, terms, route, security, and result questions. Coverage is not endorsement.

• Read the exchange eligibility audit

  Check jurisdiction, KYC, referral, deposit, UID, and product-access evidence before deciding what authority a connected route may receive.

• Use the API-key permission evidence library

  The procedural library helps inspect permission requests and key-control evidence for a particular connection. It is not a provider ranking surface.

• Use the automation failure-mode library

  The educational matrix separates parser, network, exchange, configuration, and lifecycle failures. It does not establish that a listed failure occurred here.

• Read the commercial terms audit

  Pricing, renewal, refund, merchant, and access evidence should remain separate from technical execution authority.

• Read the operator and team audit

  Operator identity and accountability are relevant to route attribution, but identity evidence alone does not establish permission safety.

• Read the performance-claims audit

  Automated execution does not validate win rates, accuracy, account returns, or future profitability.