Riset terverifikasi sumber: Kraken DEAD MAN Switch

Decision Matrix

Source Map

• Kraken API Center: Dead man's switch (kraken-deadman)
• Kraken API Center: Cancel All Orders (kraken-cancel-all)
• Kraken API Center: Get API Key Info (kraken-key-info)

Control Notes

1. Endpoint scope

Endpoint scope is the point where public documentation must become an operating rule. In this package, it means futures dead-man behavior and spot cancel-all behavior are not the same control. The practical action is to identify market, product lane and endpoint before testing. The unresolved edge is whether a strategy spans both surfaces, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

2. Authentication

Authentication is the point where public documentation must become an operating rule. In this package, it means APIKey and Authent headers must be valid before the timer matters. The practical action is to test auth failure handling and never log secrets. The unresolved edge is whether credential rotation changes behavior mid-run, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

3. Refresh cadence

Refresh cadence is the point where public documentation must become an operating rule. In this package, it means the timer protects only if refresh calls happen predictably. The practical action is to run a local scheduler test with clock and network jitter. The unresolved edge is whether the runtime pauses during system sleep, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

4. Zero deactivation

Zero deactivation is the point where public documentation must become an operating rule. In this package, it means timeout zero is a special off switch. The practical action is to test deactivation in a harmless environment. The unresolved edge is whether a later worker accidentally re-enables the timer, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

5. Error handling

Error handling is the point where public documentation must become an operating rule. In this package, it means rate limit and nonce errors can break the refresh loop. The practical action is to alert on error classes and pause order placement. The unresolved edge is whether retries create duplicate risk, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

6. Reconciliation

Reconciliation is the point where public documentation must become an operating rule. In this package, it means cancel trigger does not by itself prove final position safety. The practical action is to query open orders, fills and positions after expiry. The unresolved edge is whether partial fills occurred before cancellation, so the article keeps that edge explicit instead of turning it into a reward claim, licensing claim, approval claim, safety guarantee, recovery promise, platform ranking or price implication.

The operating test is narrow.

Known Unknowns

• whether a strategy spans both surfaces
• whether credential rotation changes behavior mid-run
• whether the runtime pauses during system sleep
• whether a later worker accidentally re-enables the timer
• whether retries create duplicate risk
• whether partial fills occurred before cancellation

Practical Takeaway

Kraken's dead man's switch should be treated as an outage-control mechanism, not as a generic safety label. Kraken futures documentation says the cancelallordersafter endpoint lets a user send a timeout in seconds that starts a countdown and cancels all user orders when it expires; the user must keep refreshing the timeout or deactivate it by specifying zero. The documentation recommends calls every 15 to 20 seconds with a 60-second timeout. The useful readiness checklist is to test authentication, refresh cadence, zero deactivation, server time, rate-limit errors, order scope and recovery evidence before relying on it during a live strategy. The article stops at the evidence boundary. It helps the reader decide what to inspect next without converting public documentation into a promise that a private account, wallet, API key, pool route, stablecoin balance, tokenized asset or policy framework will work under every future condition.