How to Revoke an Exchange API Key Properly

There is a specific and common failure here, and it produces a false sense of having cleaned up. Someone stops using a tracker, deletes the connection inside it, maybe deletes the account, uninstalls the app, and considers the matter closed. The key is still live at the exchange, still returning balances to anyone who has a copy, and it will keep doing that indefinitely.

Understanding why takes thirty seconds and fixes the habit permanently.

Why does deleting the connection in the app not revoke anything?

Because the app never had the authority in the first place.

An API key is issued by the exchange, stored by the exchange and validated by the exchange on every request. What the app holds is a copy of a credential, in the same way your building's front door key is a copy of something the lock decides about. Deleting the connection inside the app throws away that copy. It sends no instruction to Binance or Kraken, and those exchanges will keep honouring requests signed with that key because as far as they are concerned nothing has changed.

The gap matters if any other copy exists. A backup of the service's database. A logged support ticket. A breached server. A former employee's export. None of those are exotic; they are the ordinary ways credentials outlive the products that requested them. Is it safe to connect an exchange covers why that database of read-only keys is the honest risk in the arrangement.

Deleting at the exchange works in the other direction and works completely. The key stops validating immediately, everywhere, for everyone, including for you. The app you were using will show a broken connection within a refresh or two, which is the confirmation you wanted.

So the order is fixed, and it is the reverse of what most people do:

1. Delete the key at the exchange. This is the step that ends access. Everything else is housekeeping.
2. Confirm it is gone by refreshing the exchange's API management page. The key should not be listed.
3. Then remove the connection in the app. The tracker will already be failing to sync; clearing the connection stops the error and tidies the account list.
4. Reconnect with a new key if you still want the service. Generate it read-only, add the IP allowlist entry the tracker publishes, and copy the secret once, because most exchanges display it exactly once.
5. Verify the totals match the exchange after the fresh sync, since a regenerated key sometimes lands with narrower scope than the one it replaced. Auditing your tracker covers doing that comparison properly.

Where is the control on each exchange?

Wording differs. The structure is the same everywhere: a management page listing every key on the account, with a delete action per row.

Binance. On the website, the profile icon, then Account, then API Management. In the mobile app, More, then Services, then API Management. The page lists each key with its label and permissions, and each row carries a delete option. Binance's own key documentation also notes that a key without an IP access restriction is limited to read permission and cannot carry anything else, which is a useful backstop when you are auditing old keys you no longer remember creating.

Kraken. Sign in through Kraken Pro, open the account menu from the profile icon, choose Settings, then the API tab. Existing keys are listed there with management actions. Kraken also lets you set an expiry when you create a key, so a key issued for a one-off task can be made to die on its own. Use it. A key that expires is a key you cannot forget about.

Coinbase. Coinbase has moved API access into its developer portal at portal.cdp.coinbase.com, where keys are listed under API Keys. The interface is built around rotation rather than deletion: rotating expires the existing key and issues a replacement, and the configure action allows a key to be removed and recreated. Rotation achieves the security outcome, since the old credential stops validating.

Other exchanges vary in menu naming and little else. Look for API, API Management or API Keys inside account or security settings. Connecting Binance, connecting Kraken and connecting Coinbase each walk through the creation side of the same page.

One detail worth building into the habit at creation time: label every key with the service it was issued to. "Tracker", "TaxApp2025", "Bot". Exchanges let you name keys and almost nobody bothers, which is exactly why people end up staring at four unidentifiable keys two years later with no way to tell which is safe to delete.

What do I do about a key I do not recognise?

Delete it. Now, before working out what it is.

The asymmetry is stark. If the key turns out to have belonged to a service you still use, the cost is a broken sync and sixty seconds of reconnecting. If it belongs to someone else, every minute you spend identifying it is a minute of continued access. There is no version of this where investigating first is the better play.

Once it is gone, treat the discovery as a signal rather than an incident closed. Check the exchange's security or activity log for logins from addresses you do not recognise, and for the timestamp when that key was created, which usually identifies what you were doing that week. Check the withdrawal address allowlist for entries you did not add, because that is the setting an attacker actually wants. Check which devices hold active sessions and sign out the ones you cannot place. Confirm two-factor authentication is enabled and is app or hardware based rather than SMS.

If the unrecognised key carried trade or withdrawal permission, stop treating it as an API problem. Something created that key inside an authenticated session, which means the account itself was accessed. Change the password from a different device, re-enrol two-factor, and contact the exchange.

Most unrecognised keys turn out to be forgotten tax software from two Aprils ago or a tracker someone tried for a week in 2023. That is the likely explanation and it is still not a reason to leave them running. Fake crypto apps covers the less likely explanation and how the credential would have got there.

How often should I review?

Quarterly, and attach it to something you already do so it actually happens. The end of a tax quarter works. So does whatever day you rebalance.

The review is five minutes. Open each exchange's API page and delete every key you cannot name. Check that each surviving key is read-only and, where the exchange supports it, IP-restricted. Rotate anything older than six months. Then look at the connections listed inside your tracker and remove any pointing at an exchange you no longer use, since a dead connection carries the same exposure as a live one and gives you nothing back. Switching trackers covers the version of this that matters most, which is the clean-up nobody performs after moving to a different product.

The result of doing this four times a year is that the set of things able to read your accounts is always a set you chose, deliberately, recently. That is a stronger position than most people have over their financial data anywhere else, and it costs less than one evening a year.