Install and activate

Licensing the XT provider, putting the API credentials in .env, switching the platform onto XT, and running the two imports that must happen before anyone can trade.

12 min readUpdated 26 August 2026install, license, env, activation

Installing the XT provider means five things: activate the licence, install the release, switch the platform onto XT, supply the API credentials, and import the currencies and markets XT lists. The first three happen in Admin → System → Extension Manager; the rest are XT's own setup, and two of them need a shell.

Enabling XT disables whichever provider is currently active, and the currency and market imports rewrite tables that the previous provider populated. On a live install with SPOT balances, read the switching warning on the overview first.

Before you start

An XT account with API access, and a key created with the permissions listed in API keys and network access.
The server's public IPv4 address, whitelisted on that key.
The purchase code for XT — product ID 54510301 — from your MashDiv dashboard.
Shell access, for the one command that finishes the install and to edit .env and restart the backend. Every step below that touches credentials needs a restart, and no button in the admin panel performs one.

Install

Open the Extension Manager — Admin → System → Extension Manager (/admin/system/extension), the page headed Add-ons & Integrations. Use the Exchanges tab or the search box to find the XT card and click it. Until its licence is activated the chip on the card reads Activate and its switch is disabled — the tooltip says Activate license first.
1. The XT card — click it to open the product page
2. Binance reads Verified with its switch on — enabling XT in step 4 turns it off
Activate the licence — on the product page press Activate License. The licence screen opens with XT's name and product ID 54510301 shown. Paste the purchase code from your MashDiv dashboard, optionally an email address for update notifications, and press Activate License. The screen confirms License Activated! and sends you back to the product page a couple of seconds later.

If the server has no outbound access, use the License File tab on the same screen: download the licence certificate from your MashDiv dashboard, place it as license.txt in the /lic folder at the project root, and press the button on that tab.
1. Paste the purchase code here
2. Activate License — then wait for the redirect back to the product page
3. The License File tab, for a server with no outbound HTTPS
Install the release — back on the product page, now licensed, the Overview tab has a release panel. If it offers Install v…, press it; if it says Up to date on a provider you have only just licensed, press Check for Updates once, then install whatever it offers. The Releases tab holds the notes for the version you are being offered — read them first.

Install downloads the release, verifies it and extracts it over the project root. It runs no migrations, builds nothing and restarts nothing, so finish it from a shell on the server:
```
pnpm updator
```
That is the finalise chain — stop, dependencies, schema, seed data, frontend build, start. If the panel still says Up to date after the check there is nothing to download; go straight to the next step.
1. Check for Updates, then Install v… when it is offered
2. Releases — the notes for the version you are about to install
3. The Enabled switch — step 4, not yet
Switch it on — turn the Enabled switch on, in the product page heading or on the XT card in the Extension Manager, usable now that the licence is verified. Enabling XT disables every other exchange provider in the same action — only one can be active, so Binance and KuCoin are now off, whatever their licence state. XT is the platform's provider from this moment; the remaining steps give it credentials and something to list.
Add the API credentials to .env — the backend reads them by name, derived from the provider's name (xt), uppercased:
```
APP_XT_API_KEY="your_xt_api_key"
APP_XT_API_SECRET="your_xt_api_secret"
```
XT declares apiKey and secret as its only required credentials. There is no passphrase — APP_XT_API_PASSPHRASE is loaded by the shared code path but XT ignores it.
Restart the backend — credentials are read from process.env when the exchange instance is first created, and that instance is then cached for the life of the process. An edit without a restart has no effect.
```
pnpm stop && pnpm start
```
Verify the connection — go to Admin → Finance → Exchange and press Verify Credentials.

The check is not cosmetic. It builds a throwaway instance, synchronises the clock against XT, calls loadMarkets() and then fetchBalance() — an authenticated endpoint. Only a successful balance read reports valid.
Import currencies — Admin → Finance → Currency → Spot → Import.

This pulls XT's currency list with its per-network deposit and withdrawal data. Run it as a preview first; it reports what it would create, update and delete before writing anything.
1. Run the import — the first press only plans
2. Imported currencies arrive disabled
Import markets — Admin → Finance → Exchange → Markets → Import.

Same preview-then-confirm shape. It writes each symbol's precision, limits and XT's maker/taker rates into exchange_market.
1. Import Markets returns a plan before it writes
Enable the markets you want to list — imported markets arrive disabled. Enable a handful and check /market and /trade?symbol=BTC-USDT.
1. The pairs enabled on the admin markets screen

What "verified" does and does not prove

The verification button answers one question: does XT accept this key for an authenticated read, from this server, right now. It says nothing about whether the key can trade or withdraw — those permissions fail later, at the moment a customer needs them.

Read the failure messages literally, because they are distinct:

Message	Cause
`API credentials are missing from environment variables`	`APP_XT_API_KEY` or `APP_XT_API_SECRET` is empty, or the backend has not restarted since you set them
`Invalid API credentials. Please check your API key and secret.`	XT rejected the signature — wrong key, wrong secret, or the key was deleted
`Access denied: Your server's location is blocked by this exchange…`	HTTP 451. XT geo-blocks the server. Configure a proxy
`Server time synchronization failed…`	The clock drifted far enough that signed requests fall outside the receive window
`Rate limit exceeded. Please wait a moment and try again.`	You are being throttled; the ban switch may now be set

The silent failure to know about

If loadMarkets() fails for a reason that is neither a rate limit nor a timestamp error, the manager does not give up. It closes the authenticated instance and replaces it with an unauthenticated one, so that public, read-only endpoints keep working:

Falling back to an unauthenticated xt instance — authenticated data
(deposit/withdraw networks, balances) will be unavailable until valid
API credentials are configured.

That is a deliberate trade: charts and tickers survive a credential problem. The consequence is that the platform can look completely healthy on the front page while deposit-address generation, balance reads and withdrawals all fail. If customers report "no deposit address" and the trade page is fine, search the backend log for that line before anything else.

Post-install checklist

Uninstalling or switching away

Toggling XT off leaves everything else in place: currencies, markets, orders and SPOT wallet balances all stay, and so does the licence — switching XT back on later needs no reactivation. The platform simply has no active provider, and the admin exchange page shows No active exchange provider.

That is the correct state to be in while you re-import for a different provider, but do not leave it there with customer balances outstanding. With no provider active, startExchange() returns null, so orders return 503, deposits are never verified, withdrawals cannot be initiated and prices stop updating.