CEX integrations
CEX-backed actions via credentialRef. API keys stored in Thirdfy only; MCP and CLI never hold raw keys.
CEX flows use credentialRef metadata so secrets remain in Thirdfy API storage. MCP and CLI tools must not accept raw API keys in place of refs for production paths.
Venues
Catalog provider: bitfinex
CLI setup: thirdfy-agent credentials upsert --venue bitfinex
Full runbook: Agent CLI Bitfinex provider doc
For policy and limits, read Delegation and protection.