Read-Only API Keys: What a Portfolio Tracker Can and Cannot Do

The hesitation is reasonable. An app asks for a key to your exchange account, and every instinct built up from years of phishing warnings says no. So the question deserves a precise answer rather than reassurance.

A read-only API key lets a tracker ask your exchange one kind of question: what do I hold. It cannot place an order. It cannot withdraw. Not because the app promises to behave, but because the exchange will reject the request.

What do the three permission scopes actually grant?

Every major exchange splits API access into permissions you tick individually when you create a key. The names vary slightly. The structure does not.

Read grants queries. Balances by asset, open positions, order history, filled trades, deposit and withdrawal history, account structure. Everything a tracker needs and nothing else. This is the only permission a portfolio tracker requires, and it is the only one you should grant one.

Trade grants order placement and cancellation. A key with this permission can buy, sell, open and close positions at market or limit prices. It moves value between assets inside your account. It does not move value out of your account. Trading bots need this. A tracker does not.

Withdraw grants transfers off the exchange. This is the permission that can actually lose you money, and exchanges know it: most require additional protections before a key can withdraw at all, typically a mandatory IP allowlist, an email confirmation, or a separate approval step on the account. Binance's API documentation and Kraken's both spell out the constraints their withdrawal scopes carry. No portfolio tracker has any use for this permission under any circumstances.

Some exchanges add a fourth: margin or futures access, sometimes as a separate read scope. Grant the read version of it if you hold there, because otherwise those balances stay invisible.

Why can't a read-only key move my money?

Because permission checking happens at the exchange, not in the app.

When a tracker queries your balance, it builds a request, signs it with your API secret, and sends it to the exchange. The exchange looks up the key, checks which permissions were attached to it at creation, and either answers or refuses. An order request signed with a key that has no trade permission comes back as a rejection. There is no code path in the tracker that changes this, because the decision is not the tracker's to make.

This is the whole security model, and it is a good one. You are not trusting the app's intentions. You are trusting the exchange to enforce a permission you set yourself on the exchange's own website. That is a very different kind of trust, and a much cheaper one.

The residual risk is real but it is a privacy risk, not a custody risk. A leaked read-only key exposes what you hold and what you have traded. That is worth protecting. It is not worth confusing with the risk of losing funds, which read-only access does not create. What a tracker can actually see covers the exposure honestly.

What is IP allowlisting and should I turn it on?

An IP allowlist tells the exchange to accept requests signed with your key only when they arrive from a specific network address. Requests from anywhere else are refused even with a valid signature.

Turn it on wherever the exchange offers it. It converts a leaked key from a usable credential into a useless string, because an attacker holding your key and secret still cannot reach the exchange from an approved address.

One detail trips almost everyone up. The tracker queries the exchange from its own servers, not from your phone. Allowlist the address the tracker publishes in its setup instructions, not your home IP. Enter your own address and the connection will simply never work, and the failure looks like a broken key rather than a misconfiguration.

Some exchanges make an unrestricted key expire automatically after a set period while an allowlisted key persists. That is a reasonable nudge and it is worth following.

Which permissions do I switch off, specifically?

When you generate the key, the settings to look for are these. Names differ by exchange; the meaning does not.

1. Enable Reading: on. This is the permission that makes the connection work.
2. Enable Spot & Margin Trading: off. Also appears as "Trade", "Enable Trading" or "Orders".
3. Enable Withdrawals: off. Also appears as "Withdraw", "Transfer" or "Enable Universal Transfer". Universal Transfer moves funds between your own sub-accounts, which sounds harmless and is still not needed.
4. Enable Futures / Enable Margin: read access only if you hold balances there, otherwise off. Never the trading variant.
5. Enable Internal Transfer: off.
6. IP access restriction: set to restricted, with the tracker's published address entered.

Then copy the key and the secret. Most exchanges display the secret exactly once. Some, including Coinbase, KuCoin and OKX, issue a passphrase alongside it that forms part of the signature, so the key is inert without it. Connecting Coinbase covers that flow specifically.

If you tick the wrong box, do not try to edit the key. Delete it and generate a new one. Permissions on some exchanges are fixed at creation, and a key you believe you narrowed may still carry what you originally granted.

How often should I rotate a key, and when must I revoke one?

Rotation is cheap and worth doing on a schedule. Twice a year is sensible for a key you use daily. Delete the old key on the exchange first, then generate a fresh one and reconnect. The tracker will resync from scratch, which takes seconds.

Revoke immediately, without waiting for a schedule, in four situations: you stopped using the service the key was issued to, you pasted the key somewhere you should not have, your phone or laptop was lost or compromised, or the service holding the key disclosed a breach. How to revoke an API key covers where the control lives on each major exchange.

The exact wording differs by venue, and so does the damage a mis-scoped key does. Setup walkthroughs for the venues where the permission model is least obvious: Bybit, KuCoin, OKX, Bitget, MEXC and Gate.

One thing no legitimate tracker will ever ask for is a seed phrase or a private key. An API key is scoped, revocable and enforced by a third party. A seed phrase is none of those things, and anyone requesting one is attacking you. Never share your seed phrase is the shortest guide in this library for a reason.

Generate the key with read only, allowlist it, and the connection becomes what it should have been all along: boring infrastructure that keeps a number current while you think about something else.