PROJECT DOCUMENTATION
What Driftlock does
Driftlock is a rules-first crypto investing workspace that connects directly to the Robinhood Crypto Trading API. It gives each user a private dashboard for live brokerage data, encrypted credential storage, and explicit investment controls.Driftlock does not receive or custody crypto assets. Brokerage balances and assets remain in Robinhood.
Core functions
The primary capabilities available in the current application.
Protected user accounts
Users register and sign in to a personal Driftlock workspace.
Direct Robinhood connection
The user supplies a Robinhood API key and signing key. Driftlock verifies the connection and discovers the active account automatically.
Live portfolio visibility
Buying power, crypto holdings, market prices, and order history are loaded from the Robinhood Crypto Trading API.
Investment rules
Users can define asset, amount, frequency, and operating limits for recurring investment strategies.
Risk controls
Rules are designed to be evaluated against spending limits, buying power, tradability, and execution safety gates.
Non-custodial account model
Brokerage assets remain in Robinhood while Driftlock provides account visibility, rules, and controls.
User workflow
From registration to a connected Robinhood dashboard.
- 1Create a Driftlock account
Register and sign in to your protected workspace.
- 2Connect Robinhood
Enter the Robinhood API key and signing key inside the protected dashboard.
- 3Verify and discover the account
Driftlock verifies the connection and automatically selects an active crypto account.
- 4Load live brokerage data
Driftlock reads buying power, holdings, market data, and order history directly from Robinhood.
- 5Configure rules
Define strategy parameters and safety limits without using fabricated balances or simulated portfolio data.
Account data
Robinhood remains the source of truth for brokerage information.
Security model
Sensitive credentials remain protected and are never returned in dashboard data.
- Encrypted credentialsConnection credentials are encrypted at rest.
- Signed Robinhood requestsEach brokerage request is authenticated using the user's connection credentials.
- Protected sessionsAuthentication uses secure, HTTP-only session cookies.
- Private credential handlingSigning keys are never returned in dashboard responses.
- Safety-gated executionTrading remains disabled until all execution controls are validated.
How Driftlock works
A protected application layer connected directly to Robinhood.
Trading status
The distinction between available account data and live trading.
Live read-only integration
Credential validation, account discovery, buying power, holdings, market data, and order-history retrieval are implemented.
Live order submission
Real-money order execution remains disabled until lifecycle handling, idempotency, reconciliation, and failure recovery are fully validated.