Kaynak doğrulamalı araştırma: Exchange API Clock Drift

Verified source facts

1. Binance signed endpoints require a current timestamp and may use recvWindow to define how long a request remains valid. 2. OKX says private REST requests are rejected when the timestamp differs from server time by more than 30 seconds and recommends synchronizing against its public time endpoint. 3. OKX supports expTime on selected order and amendment operations so a request can be discarded after a client-defined deadline. 4. Coinbase documents clock-skew failures for JWT authentication because nbf and exp claims depend on synchronized timestamps.

Comparison at a glance

1. Control test: Clock source

A trading-control disclosure is meaningful only when converted into a testable rule. For clock source, inspect authoritative UTC time. Use a sandbox, non-production context, or the smallest reversible test available, then use a monitored synchronization service. Capture configuration and event evidence without recording credentials, and verify the documented cancel, reject, decrement, or history behavior.

Model the failure path, not just the setup path. Ask which strategy owns the maker and taker orders, which account boundary the venue evaluates, which message reveals intervention, and how reconciliation behaves after a partial fill or disconnect. Platform documentation describes supported settings; it cannot prove that an operator configured them correctly. In this dimension, upstream drift is therefore an explicit audit gap.

The clock source row should end with a concrete monitoring rule tied to authoritative UTC time. Make the operator use a monitored synchronization service, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; upstream drift remains a separate production risk until observed.

2. Control test: Measured drift

For measured drift, inspect client versus exchange time. Use a sandbox, non-production context, or the smallest reversible test available, then record drift continuously.

In this dimension, endpoint latency is therefore an explicit audit gap.

The measured drift row should end with a concrete monitoring rule tied to client versus exchange time. Make the operator record drift continuously, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; endpoint latency remains a separate production risk until observed.

3. Control test: Request timestamp

For request timestamp, inspect value included in authentication. Use a sandbox, non-production context, or the smallest reversible test available, then generate immediately before signing.

In this dimension, queue delay is therefore an explicit audit gap.

The request timestamp row should end with a concrete monitoring rule tied to value included in authentication. Make the operator generate immediately before signing, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; queue delay remains a separate production risk until observed.

4. Control test: Validity window

For validity window, inspect recvWindow or token lifetime. Use a sandbox, non-production context, or the smallest reversible test available, then use the smallest reliable bound.

In this dimension, network spikes is therefore an explicit audit gap.

The validity window row should end with a concrete monitoring rule tied to recvWindow or token lifetime. Make the operator use the smallest reliable bound, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; network spikes remains a separate production risk until observed.

5. Control test: Explicit expiry

For explicit expiry, inspect deadline for order processing. Use a sandbox, non-production context, or the smallest reversible test available, then set expTime where supported.

In this dimension, server coverage is therefore an explicit audit gap.

The explicit expiry row should end with a concrete monitoring rule tied to deadline for order processing. Make the operator set expTime where supported, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; server coverage remains a separate production risk until observed.

6. Control test: Retry

For retry, inspect behavior after timing rejection. Use a sandbox, non-production context, or the smallest reversible test available, then re-sync before retry.

In this dimension, duplicate execution is therefore an explicit audit gap.

The retry row should end with a concrete monitoring rule tied to behavior after timing rejection. Make the operator re-sync before retry, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; duplicate execution remains a separate production risk until observed.

7. Control test: Idempotency

For idempotency, inspect client order identity. Use a sandbox, non-production context, or the smallest reversible test available, then reconcile before resubmission.

In this dimension, venue semantics is therefore an explicit audit gap.

The idempotency row should end with a concrete monitoring rule tied to client order identity. Make the operator reconcile before resubmission, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; venue semantics remains a separate production risk until observed.

8. Control test: Acknowledgement

For acknowledgement, inspect request accepted by gateway. Use a sandbox, non-production context, or the smallest reversible test available, then wait for authoritative order state.

In this dimension, late processing is therefore an explicit audit gap.

The acknowledgement row should end with a concrete monitoring rule tied to request accepted by gateway. Make the operator wait for authoritative order state, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; late processing remains a separate production risk until observed.

9. Control test: Monitoring

For monitoring, inspect drift, latency and expiry counters. Use a sandbox, non-production context, or the smallest reversible test available, then alert before trading impact.

In this dimension, silent partial failure is therefore an explicit audit gap.

The monitoring row should end with a concrete monitoring rule tied to drift, latency and expiry counters. Make the operator alert before trading impact, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; silent partial failure remains a separate production risk until observed.

10. Control test: Fail closed

For fail closed, inspect uncertain time or state. Use a sandbox, non-production context, or the smallest reversible test available, then block new risk until reconciled.

In this dimension, missed opportunity is therefore an explicit audit gap.

The fail closed row should end with a concrete monitoring rule tied to uncertain time or state. Make the operator block new risk until reconciled, retain the venue response, and assign an owner for exceptions. Documentation quality is a useful signal, but it does not certify the exchange or the trading system; missed opportunity remains a separate production risk until observed.

Decision scenarios

Scenario 1: when clock source becomes decisive

Consider a reader whose main constraint is authoritative UTC time. The correct response is not to infer a universal platform or product winner. It is to use a monitored synchronization service, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when measured drift becomes decisive

Consider a reader whose main constraint is client versus exchange time. It is to record drift continuously, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when request timestamp becomes decisive

Consider a reader whose main constraint is value included in authentication. It is to generate immediately before signing, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when validity window becomes decisive

Consider a reader whose main constraint is recvWindow or token lifetime. It is to use the smallest reliable bound, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when explicit expiry becomes decisive

Consider a reader whose main constraint is deadline for order processing. It is to set expTime where supported, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when retry becomes decisive

Consider a reader whose main constraint is behavior after timing rejection. It is to re-sync before retry, retain the evidence, and define a stop condition before funds or permissions are committed.