Back-office tool - trdrs Engine API

The back office is an optional, installable business tool. TRDRS hosts the engine and trading state; your installation hosts the business UI and its small server. Your own backend can use the same Venue API without installing this tool.

Before you start

Sign in to sandbox API access.
Create or select your venue and create a Venue key. For every operation in the tool, select venue:read, venue:configure, account:read, account:issue, risk:halt, provider:manage, connection:manage and stage:advance. A read-only installation can use just venue:read and account:read; writes then return 403.
Save the venue ID and keep the secret in your server environment.
Prove the key with the business quickstart.

Use a separate key for each installation so it can be revoked independently. Keys, owners and venue creation remain in your TRDRS profile. The installed tool links there for those actions.

Install version 0.1.0

Use Node.js 22 or newer. Start in a new directory so installation cannot overwrite an existing project:

mkdir trdrs-backoffice-install
cd trdrs-backoffice-install
curl --fail --location --remote-name https://trdrs.co/downloads/trdrs-backoffice-0.1.0.tgz
curl --fail --location --remote-name https://trdrs.co/downloads/trdrs-backoffice-0.1.0.tgz.sha256
shasum -a 256 -c trdrs-backoffice-0.1.0.tgz.sha256
tar -xzf trdrs-backoffice-0.1.0.tgz
cd trdrs-backoffice-0.1.0
cp .env.example .env
chmod 600 .env
node scripts/hash-password.mjs

The password prompt does not echo what you type. Store the printed password hash in .env as TRDRS_BACKOFFICE_PASSWORD_HASH. Do not put a password in a shell command or source control. On Linux, sha256sum -c can replace shasum -a 256 -c. Stop if checksum verification fails. Edit .env with the venue ID and key from your TRDRS profile:

TRDRS_ENVIRONMENT=sandbox
TRDRS_API_URL=https://sandbox.trdrs.co
TRDRS_VENUE_ID=your-venue-id
TRDRS_VENUE_KEY=your-server-held-venue-key
TRDRS_BACKOFFICE_USERNAME=operator
TRDRS_BACKOFFICE_PASSWORD_HASH=your-generated-password-hash
TRDRS_APP_ORIGIN=https://sandbox.trdrs.co
HOST=127.0.0.1
PORT=8787
TRDRS_SECURE_COOKIE=false

TRDRS_SECURE_COOKIE=false is for this loopback HTTP check only. For a deployment, serve the tool through HTTPS and set it to true.

node --env-file=.env server/server.mjs

Open http://127.0.0.1:8787 and sign in with the operator username and password you just configured. This operator login belongs to your installation; traders continue to sign in to TRDRS. No package registry account or access to the private TRDRS repository is required to run the bundle.

Run in a container

The archive contains a Dockerfile and .dockerignore that excludes local credentials. Build from the extracted directory and provide secrets only when starting the container:

docker build -t trdrs-backoffice:0.1.0 .
docker run --rm --env-file .env -e HOST=0.0.0.0 \
  -e TRDRS_PUBLIC_ORIGIN=http://127.0.0.1:8787 \
  -p 127.0.0.1:8787:8787 trdrs-backoffice:0.1.0

For a hosted installation, configure HTTPS at your reverse proxy, keep the server private behind it, set TRDRS_PUBLIC_ORIGIN to that exact external HTTPS origin, and use your deployment service’s secret store. Do not copy .env into an image. Version 0.1.0 requires the September 21, 2026 Venue API, including branding with expectedUpdatedAt and the instrument reference endpoint. The archive’s COMPATIBILITY.md, TERMS.md and third-party notices travel with each release. The internal TRDRS UI packages are not separate public packages; the runnable tool includes their compiled components.

What runs where

Your installation	TRDRS
Back-office UI and operator login	Engine and authoritative account state
Venue key in the server’s environment	Scope, ownership and environment checks on every request
Server requests to the public Venue API	Trading enforcement, providers and account streams

The browser never receives the Venue key. An operator signs in to the back-office server, which accepts only its configured venue and allowed operations. It is not a general proxy to the engine.

Verify your installation

Before using write actions, check that the displayed venue and environment match the key you configured. Read its accounts, including Existing accounts with Original rules. Reading those accounts does not assign a group, change a balance or alter trading rules. For write tests, create a dedicated sandbox setup and follow the business workflow. Confirm branding, configuration and accounts through the API and trader view before relying on them. A saved provider declaration does not prove real provider execution.

Operating it

Keep the app behind HTTPS when it is reachable beyond your local machine.
Protect operator access and the server environment; a Venue key is authority over your venue.
Rotate a key in the TRDRS profile, update the server secret and restart the tool. Revoking an old key invalidates its next engine request; restarting must not bring the old key back.
Keep sandbox and production installations separate. Production needs an explicit production base URL and matching key. Switching endpoints copies no accounts or balances.
Pin the tool version and test upgrades in sandbox. Back up deployment configuration without putting credentials in source control.

The hosted sandbox back office remains available during migration. It is not required for direct API access.

​Before you start

​Install version 0.1.0

​Run in a container

​What runs where

​Verify your installation

​Operating it