let's say I would like to create a service like eToro that allows people to trade stocks but with their own brokers. If I do it just for me, it's pretty straightforward:
- create logic that replicates someone's trades (or from my own instructions)
- use my API keys to get the best price with my brokers and trade
Now if I want to share this with people I don't know, and who are not technical, the minimum I would need from them is their API key to trade "for them" (let's imagine we put all the legal stuff aside with waivers etc...). How could I, technically do that? Below are my concerns:
- if I store the keys myself, I could be hacked which brings liability
- if I store the keys myself, I could use it for my own benefit (not the intention but you know what I mean)
so I am looking for, and haven't found yet, a service or a design pattern that would allow me to mitigate that, do you know what that could be?
What I had in mind:
- a third party like 1Password, but better, as I need to remove the need to validate the unlock AND sees the passwords (the service is automated)
- or a technical approach like OAuth but where I can guarantee that I can't decipher the message (whereas in my case if I get the public key only, than the user would need to use manually the private key all the time, so no automation or if I have public + private, then I could decipher the message and get the API key...)
Does this makes sense? Thanks for your help!