Brokers

Vectaris trades through your own broker accounts — it never holds your funds, only your credentials and your instructions.

Supported brokers

Two non-broker adapters round out the list: a Mock broker that simulates fills without a real account, so you can evaluate Vectaris or test a workflow before connecting a live adapter; and an Imported adapter that serves data from CSV files you supply yourself instead of a live feed (see Can I import my own data?).

Connecting

Connect a broker from the account selector's Connect Account modal — pick the adapter and enter your credentials, then Test Connection and Connect.

How Vectaris holds your keys

Your key goes from the connect form to the Vectaris servers once and is never sent back to your browser. The servers make every call to your broker that needs it — orders, balances, your own fills — and your browser only names which connection to use. Saved keys are encrypted with a key of their own and bound to your account; if you choose Don't save (Settings → Storage), a demo, sandbox or paper key is held only in a Vectaris server's memory for your session and you enter it again later. Live keys are always saved. Market data that needs no key still comes straight from the venue to your browser.

When you create a key at your broker, give it read and trading permissions only — never withdrawals or transfers — and, where the broker allows it, restrict it to the Vectaris server addresses the connect form shows. Removing a connection deletes its key at once.

Simulated modes are free; live needs Early Supporter

Every broker that offers a simulated mode connects in it on a free account. Connecting in a live mode — real money — needs an Early Supporter subscription ($5/month, from the account menu at the right of the toolbar). Early Supporter also syncs your assistant chats across devices (see the AI Assistant page, Saved chats).

The Mock and Imported adapters are free. If a subscription ends, live connections are disconnected at the end of the paid period and simulated ones keep working.

Coinbase

Coinbase issues API keys from its Developer Platform portal (portal.cdp.coinbase.com → API keys → Secret API keys), not from the exchange's settings. Creating one shows two things: the key's name, a long organizations/…/apiKeys/… path, and a secret shown exactly once. Pick Ed25519 when the portal offers a choice of algorithm — it is what Coinbase now recommends — though an ECDSA key works too. Paste the name and the secret into the connect form as Coinbase gave them to you: the base64 Ed25519 secret, or either PEM form (-----BEGIN EC PRIVATE KEY----- or -----BEGIN PRIVATE KEY-----), line breaks or not.

The older Advanced Trade keys — a short key and a secret that signed each request with HMAC — stopped working in February 2025. A connection saved with one of those fails its test with a message saying so; create a CDP key and connect again.

The Vectaris servers hold the secret and sign each request with a token minted for that one request and good for two minutes; your browser never sees the secret or the tokens. Live prices arrive on Coinbase's public market-data socket, straight to your browser; your own orders and fills arrive on its user socket, which the servers open and authenticate for you. A passphrase-encrypted PEM is the one key Vectaris cannot read, for the reason given under Kalshi below.

Kalshi

Kalshi authenticates differently from the others. Instead of a single API key it issues a key id plus an RSA private key, downloadable once when you create the key. Paste the key id and the whole .pem file into the connect form, exactly as Kalshi gave it to you — both the -----BEGIN RSA PRIVATE KEY----- form Kalshi issues today and the -----BEGIN PRIVATE KEY----- form other tools produce are accepted. The Vectaris servers sign each request and the live feed's connection with it; the key is never sent back to your browser.

The one key Vectaris cannot read is a passphrase-encrypted one (-----BEGIN ENCRYPTED PRIVATE KEY-----), since unlocking it would mean asking you for the passphrase. Decrypt it first:

openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-decrypted.pem

Hyperliquid

Hyperliquid is an exchange that runs on its own chain, so there is no API key to copy. The account is the wallet you deposited with, and the venue lets that wallet approve an API wallet — a separate key that may place and cancel orders for the account and may never withdraw or transfer from it. That API wallet is the only key Vectaris holds. There are two ways to give it one:

• Connect a wallet. With a browser wallet installed (MetaMask, Rabby, Coinbase Wallet…), the connect form shows a button for each. The Vectaris servers generate a fresh API wallet and show your wallet only its address; your wallet signs a single approval message naming it — no transaction, no gas. The API wallet's key never reaches your browser. The approved key is named vectaris on your account, so you can find and revoke it under More → API on the Hyperliquid app. Your wallet is never asked to sign again.
• Paste an API wallet. Generate and authorize one under More → API on the Hyperliquid app, then paste your account address and the API wallet's private key.

Either way the form refuses the account's own private key: Vectaris only ever holds a trading-only key, and its servers sign your orders with it. Account data and the live feed are public on Hyperliquid and come straight to your browser. Testnet is a separate environment with its own account and API wallets.

Symbols are BTC-PERP for perpetuals and HYPE-USDC for spot pairs; prices are in USDC and sizes in the coin. The venue has no market orders, so a market order is sent as an immediate-or-cancel limit five percent through the current mid — the same thing its own app does — and it accepts at most five significant figures on a price, so the price you typed may be rounded in its last digit. Stops are the venue's trigger orders and rest on its books, not in your browser.

Polymarket

Two exchanges share the name, and the first thing the connect form asks is which one you hold an account with. Polymarket (international) is the on-chain venue at polymarket.com, traded from a wallet. Polymarket US is the CFTC-regulated exchange at polymarket.us, traded with an API key from its developer portal. They share nothing on the wire — not markets, not prices, not positions — so each account remembers which venue it belongs to, and the form only shows the fields for the one you pick.

Polymarket (international)

The international venue settles on the Polygon chain, and like Hyperliquid it has no API key to copy: the account is a wallet, and every order is a signature from it. Polymarket offers no trading-only key — a key that can sign an order there can also move funds — so Vectaris never asks for, receives or stores your wallet's private key. Instead:

• Connect with your browser wallet. With MetaMask, Rabby, Coinbase Wallet or another browser wallet installed, the connect form shows a button for each. Your wallet signs one message proving it controls the account (no transaction, no gas), and the Vectaris servers exchange that signature for the API credentials Polymarket issues to your wallet. Those credentials can read your account and submit orders you have signed; they cannot sign an order or move funds.
• Account type. How you signed up: email/Google login, browser wallet, or a plain wallet that holds the funds itself. The venue checks signatures differently for each, so a wrong choice is a rejected order, not a wrong one.
• Polymarket wallet address. The 0x… address on your profile page. For email/Google and browser-wallet accounts this is a proxy wallet the venue made for you, which holds your USDC and positions. A plain wallet leaves it blank.

Every order is signed by your wallet, in its own prompt, before Vectaris submits it — expect one confirmation per order. If you log into Polymarket with email or Google, your signing key lives with Polymarket's login provider: export it from Settings → Export private key on polymarket.com and import it into a browser wallet first, then connect with that wallet. A Polymarket connection saved before October 2026 held the wallet key; it no longer works and asks you to reconnect with a wallet.

Symbols are the market's URL slug — will-the-fed-cut-rates-in-march, the last segment of its polymarket.com address — and the Event Browser and every symbol box find them by name. Prices are cents like Kalshi's, though some markets tick at a tenth of a cent and the ladder rounds those onto whole cents. A market's two outcomes are not always Yes and No — a game's moneyline is "Lions" and "Bills" — so the browser shows each side's name beside the YES/NO buttons; YES is always the first outcome named in the question. A market order is sent as a limit at the price the current book reaches for your size, fill-and-kill, so whatever cannot fill at that price is dropped rather than left resting. There is no request-for-quote on Polymarket; the gavels stay hidden.

Polymarket US

Polymarket US issues an ordinary API key. In the Polymarket US app, complete identity verification, then open polymarket.us/developer and create a key. The form asks for two things.

• Key ID. The key's identifier from the developer page.
• Secret key. Shown once, when the key is created. It is an Ed25519 signing key: the Vectaris servers sign every request and every live-feed connection with it, and it is never sent back to your browser. The public API it unlocks trades and reads the account; deposits and withdrawals stay in the app.

Public market data (the catalogue, books, price history) comes straight from the venue to your browser. Everything tied to your account, and both live feeds, go through the Vectaris servers, which add the signature.

Symbols are the market's URL slug, the last segment of its polymarket.us address, and the Event Browser and every symbol box find them by name. Each market is one instrument, the YES side; NO is priced by crossing it, so a NO bid is 100 minus the YES ask. Prices are cents like Kalshi's, and the venue ticks at a tenth of a cent, so the ladder rounds onto whole cents. As on the international venue a market's two outcomes are not always the words Yes and No — a moneyline reads "Chargers" and "Titans" — and the browser shows each side's name beside the YES/NO buttons. Market orders are the venue's own. Polymarket US also quotes combinations on request: press the gavel beside two or more outcomes of its combinable events and the request-for-quote sidebar builds the combination and asks the venue's makers to price it (see Requesting quotes for size below).

Prediction markets

Event contracts do not behave like the other instruments, and two things follow from that.

Orders have two axes, not one. Every market is a claim that settles at 100¢ if it happens and 0¢ if it doesn't, and you can take either side of it. So an order says both a direction (buy or sell) and an outcome (yes or no) — the order ticket grows an extra selector for Kalshi and Polymarket accounts, on either Polymarket venue. Vectaris will not guess the outcome for you: buying YES when you meant NO takes the opposite position at close to the inverse price, so an order that doesn't name one is refused rather than defaulted. For the same reason, a click on the SuperDOM ladder opens the ticket instead of firing directly.

Prices are probabilities. A contract at 45¢ is the market saying 45%. Vectaris shows these as percentages throughout, not as dollar amounts.

One module exists for prediction markets specifically. Event Browser walks the catalogue by category — events, and the markets inside them — because event tickers are generated per event and expire, so nobody remembers one. Any symbol box finds them by name instead: a team, a coin or a question typed roughly ("lions", "bitcion", "fed march") matches the open events, and a ticker typed exactly or in part still comes first. Opening an event shows its outcomes as a ladder with YES and NO priced side by side; clicking either fills the ticket with that side. The open event also shows the rule that settles it and who calls it, any position you hold in it, and for a mutually-exclusive event what its legs sum to, which should be about 100% — a number far off that means the book is thin or stale. Prices on an open event are re-read every few seconds. Every event carries a small icon for what it is about — its league or sport, a coin, a company, a country — and each side of a game shows its team as a badge; anything without a more specific picture shows the glyph of its category.

Requesting quotes for size

Kalshi and Polymarket US. The international Polymarket venue offers no request-for-quote, so on one of its accounts the sidebar and the gavels are hidden.

Large orders walk a thin book. The Event Browser's request-for-quote sidebar asks market makers to price a whole clip privately instead. Press the gavel beside any outcome to put it in the request — one outcome is quoted as it stands; several become a combination the venue builds first, where a template allows it — set the size, and quotes come back within seconds, each a two-sided price for the full amount.

Combinations only exist inside the venue's templates, which cover a small slice of the catalogue. The browser's Combinable filter lists exactly that slice, and once a leg is down the gavel greys out on every outcome no template can combine with it.

On Polymarket US every quote is on a combination: the venue quotes its own combo instruments and nothing else, so a single outcome cannot be sent for a quote there — add a second leg. Its one template is the set of markets it flags as combinable (its sports events, some two thousand of them), two to ten legs in any order, and the venue builds the combination itself when you send the request. The maker's last-look and execution deadlines come back on the quote, and the ticket counts down to those rather than to a fixed window. The venue runs its combos and request-for-quote API as a beta it enables per account: until Polymarket US has turned it on for your key, the gavels stay hidden on that account, and a request made with a key it has not enabled is refused with a message saying so — ask Polymarket US for access.

Accepting one is a two-step commitment. You accept a side, and the maker then has a short window — 30 seconds on most Kalshi markets, 3 seconds on high-volatility ones, and whatever Polymarket US states on the quote — to confirm. Once they confirm, neither side can withdraw, and the orders post shortly after. The ticket shows both deadlines counting down. If the window passes without a confirmation, the quote lapses and nothing trades.

You can hold one open request per market at a time. Quoting back — pricing other people's requests — is not supported.

Data & queries per broker

Every connected broker exposes accounts, balances, orders, positions, and fills (where the broker provides them) as VectarisQL collections you can pull into a DataGrid or chart. Which collections and bar intervals a given broker supports varies — see the collections reference for the exact columns and intervals per broker.

Paper and live

Deployments run in your browser while the tab stays open — the attended model: close the tab and the deployment stops, it doesn't keep trading unattended in the background. Paper is the default; arming a deployment for live trading requires the account's environment to be live and a typed LIVE confirmation, plus risk limits filled in before it can start. A kill switch pauses every running deployment and cancels its working orders in one click. Deployments never auto-resume after a reload — they come back paused, with a reconciliation banner you have to confirm before they continue.

Live execution has been exercised end-to-end against the built-in Mock broker; running it against a funded account at a real broker is not yet a validated path. Treat live deployment as experimental, and start in paper.