Hello everyone! Our team wants to create new perfect and perspective BITCOIN EXCHANGE. We ask you to share with us your opinion, ideas about exchanges that you know: their advantages that you like, disadvantages, which are annoying you. Thank you for your answer.
Use HMAC(Or other MAC based Signing Algorithm) To sign API calls, with a timebased nnonce. It's a good way to rate limit your api and stop bruteforcers. also enforce strict call limits and ip bans. white list only known applications. make users have to request access manually, and optionally only from verified accounts. Anyone who refuses to verify their identity only wants access to your api for one thing: to hack it. Don't be stupid like mintpal, myself and many others. Do like cryptsy and arm your application to the teeth with Hacker crushing diamond tipped razorblades.
Also, pay for a security audit of your code up front. Don't trust the developers to deliver you bulletproof code. They may deliver swisscheese disguised as gold. If it looks pretty, don't trust it.