Binance Keeps Your Money in Nine Places. Track All of Them.

Open Binance and the figure at the top of the screen is a sum. Behind that sum, your balance sits in compartments Binance treats as genuinely separate systems: the spot wallet, the funding wallet, cross margin, isolated margin, USDⓈ-M futures collateral, COIN-M futures collateral, Simple Earn flexible, Simple Earn locked, and whatever is committed to Launchpool. Move USDT from spot into Simple Earn and Binance's own total does not flinch. An API key with the wrong scope will.

This is why the usual complaint about connecting Binance is not that it failed. It is that it worked, and the number came back too low.

Where do I create the key, and what am I choosing?

Do this in a desktop browser. Binance keeps key creation on the website: click the profile icon, then Account, then API Management, then Create API.

The first decision is key type. System-generated issues you an API key and a secret and signs requests with HMAC. Self-generated means you produce an Ed25519 or RSA keypair yourself and hand Binance only the public half. Self-generated is stronger in principle, since the private key never touches Binance's servers, but most portfolio trackers ask for a key and a secret in two text fields. Pick system-generated unless your tracker explicitly supports Ed25519.

Name the key after the app you are giving it to. Not "api1". When you have four keys on the page in a year's time and want to kill one, the name is the only thing that tells you which.

Binance then shows the permission list, and this is where the article earns its keep.

Which boxes do I tick, exactly?

The names below are Binance's own, and the meaning of each is worth reading rather than skimming.

1. Enable Reading: on. This is the entire permission a tracker needs. It grants balance queries, order history, trade history and account structure across the wallets the key can reach.
2. Enable Spot & Margin Trading: off. This places and cancels orders. A tracker has no use for it.
3. Enable Futures: read access only, and only if you hold futures collateral. Binance treats futures visibility as its own scope, so leaving it off is the single most common reason a derivatives trader's tracked total is short. Never grant the trading form of it.
4. Permits Universal Transfer: off. This moves funds between your own Binance wallets and sub-accounts. It sounds internal and harmless. It is neither necessary nor harmless.
5. Enable Withdrawals: off, permanently. Binance makes an IP allowlist mandatory before this can even be switched on, which tells you how the exchange rates the risk.
6. Enable Internal Transfer and Enable Symbol Whitelist: both off. Neither has anything to do with reading balances.

A read-only key cannot buy, cannot sell, and cannot send a coin anywhere. That is not a promise the tracker makes; it is a rule Binance enforces at its own edge, checked on every signed request. Read-only API keys sets out why the enforcement point matters more than the app's intentions.

There is a useful side effect of Binance's own policy here. An HMAC key created without an IP restriction is only permitted to carry reading permissions in the first place. If you leave the allowlist blank, Binance will not let that key trade even if you tick the box by accident.

Do I need an IP allowlist, and will the key expire?

If your tracker publishes a static outbound address, allowlist it. The address to enter is the tracker's server address, not your phone's and not your home router's, because the query leaves the tracker's infrastructure rather than your handset. Enter your own IP and the connection fails in a way that looks exactly like a bad secret.

Expiry is the part people get wrong from stale advice. Binance has for years automatically deleted keys that carry no IP restriction, using a fixed lifetime from creation and a separate inactivity window, and the specifics have been revised at least twice. What you should do is not memorise a number. Open the API Management page, look at the status and any expiry shown against the key, and set a calendar reminder to check quarterly. If a tracker's Binance balance freezes on a date and never moves again, a silently deleted key is the first thing to test. Revoking and rotating a key covers the replacement flow.

What will a Binance connection never show me?

Plenty, and it is better to know now than to hunt a phantom gap later.

Sub-accounts are the big one. A retail master key does not see them. Each sub-account needs its own key, created from inside that sub-account and connected as a separate venue in the tracker. Anyone who set up a sub-account for a bot two years ago and forgot has a hole in their net worth right now.

Binance Pay balances, P2P funds held in escrow mid-trade, and Binance Card balances sit outside the wallets a standard read key enumerates. Locked Simple Earn and Launchpool positions surface inconsistently depending on which endpoints the tracker calls. Dual Investment subscriptions are not a token balance at all until they settle, so there is often nothing for a tracker to read. NFTs held in the Binance NFT marketplace are not part of a balance query either.

For anything in that list, the honest fix is a manual position with its real acquisition price, so the amount is counted and the cost basis stays intact. Adding a manual position is a two-minute job and it stops the reconciliation from going in circles.

The last category is regional. Binance.com, Binance.US, Binance Japan and the other licensed entities run separate books on separate API domains. Keys are not portable between them. If you hold on two of them, that is two connections, and the tracker should show two accounts.

Is this actually safe to do?

The risk of a read-only key is a privacy risk, not a custody risk, and the distinction is not a technicality. Someone holding your key and secret can see what you own and what you traded. They cannot take any of it, because the withdrawal permission they would need was never attached to the credential. Is it safe to connect an exchange works through the threat model properly, and what a tracker can see is the companion piece on exposure.

Generate one key per app. It costs nothing, and when you drop a tracker you revoke exactly one credential instead of guessing which of three is which.

Once the key is in, do the boring part immediately: open Binance in one window and the tracker in the other and compare the totals while the memory of which boxes you ticked is fresh. A gap of more than a percent or two is not price drift, it is a wallet the key cannot reach, and why your portfolio balance is wrong lists the usual suspects in order. Fix it on day one and Binance becomes the least interesting line in your portfolio, which is precisely what you want from an exchange you check daily.