Your Bybit API Key Expires in 90 Days. Set It Up So It Doesn't.

Here is how it usually goes. You connect Bybit to a tracker in January, everything syncs, and you stop thinking about it. Some time in April the Bybit line stops updating. You do not notice for a while, because a number that changes slowly still looks like a number that is working. Then you reconcile in June and find your portfolio has been quietly wrong for two months.

Bybit deletes API keys that were created without an IP restriction after roughly three months. This is not a fault and nothing was compromised. It is a policy, and it is the single most important thing to know about connecting Bybit to anything.

So the setup has two goals: grant the narrowest possible permission, and make the expiry a thing you have planned for rather than a thing that ambushes you.

How do I create the key?

Do this on the website. The profile icon in the top right leads to API, and from there to API Management and Create New Key.

1. Choose the key type. Bybit offers system-generated keys, which issue an API key and secret signed with HMAC, and self-generated keys, where you build an RSA keypair and upload only the public half. Portfolio trackers ask for a key and a secret, so pick system-generated.
2. Say what the key is for. Bybit distinguishes keys bound to a listed third-party application from keys for your own use. If your tracker appears in the list, choose it. If not, choose the self-use option, which is what most tracker connections need.
3. Select Read-Only. This is the part Bybit gets right and most exchanges do not. Rather than burying read access among a dozen checkboxes, Bybit puts a top-level choice between Read-Only and Read-Write at the head of the permissions block. Choose Read-Only and the trading and withdrawal capabilities are simply not on the table for this credential.
4. Tick the permission groups you need. Under Read-Only these are scopes rather than powers. Unified Trading covers your main balances. Assets, sometimes shown as Wallet, covers account and transfer records. Add Exchange and Earn if you use them. Leave anything about withdrawal, subaccount transfer or account transfer alone regardless of what the Read-Only header implies, because a key you later widen carries whatever you originally ticked.
5. Decide on the IP restriction. Bind the tracker's published server address if it has one, and the key persists. Leave it unrestricted and start the ninety-day clock.
6. Copy the key and secret. Bybit shows the secret once.

A Read-Only key cannot buy, cannot sell, and cannot send anything off Bybit. That is not a promise the tracker is making. Bybit checks the scope attached to the key on every signed request and refuses whatever falls outside it, which means the enforcement sits with the exchange rather than with the app you handed the credential to. Read-only API keys sets out why that distinction carries the entire security argument, and is it safe to connect an exchange is direct about the residual exposure.

Where has half my balance gone?

Into the Funding account, most likely.

Bybit runs two things that both look like "your money". The Unified Trading Account is the consolidated one, merging spot, margin and derivatives collateral so a single pool of margin backs everything you trade. It was a real simplification when Bybit introduced it, and it is where an active trader's balance lives.

The Funding account is separate, and it is busier than people expect. Deposits land there. Withdrawals leave from there. Earn principal and yield return there at maturity. P2P trades settle there. Crypto Loans, Launchpad subscriptions and the Bybit Card all draw on it. Money moves between Funding and the Unified Trading Account only when you transfer it, or when you have enabled the auto-transfer setting.

The consequence for tracking is direct. A stablecoin balance you parked in Funding after closing a position, or an Earn subscription that matured last week, sits in a compartment that a connection scoped only to trading balances will not report. Check the holdings list against Bybit's own asset overview section by section rather than comparing totals, because a total that is short by one compartment looks identical to a total that is short for six other reasons. Why your portfolio balance is wrong works through the rest of them.

What will not come across?

Sub-accounts are the first gap. Every Bybit sub-UID needs its own API key, created for that sub-account, and added to the tracker as a separate connection. Anyone who spun up a sub-account for a trading bot or a copy-trading allocation has money the main key cannot see.

Open derivatives positions are the second, and they are a genuine modelling problem rather than a permissions one. The collateral backing a perpetual is a balance and reads cleanly. An open position with unrealised profit is not a balance, it is exposure, and trackers differ in whether and how they represent it. Look at what the holdings list actually contains before you decide the total is complete.

Funds locked in Bybit Card spending, escrowed mid-P2P-trade, or committed to a Launchpad subscription are similarly not straightforward token balances. Where something matters and does not import, enter it as a manual position with its real acquisition price, so the quantity counts and the cost basis survives. Adding a manual position is a minute of work per holding.

How do I stop the expiry from catching me out?

Pick one of two disciplines and actually keep it.

If your tracker publishes a static outbound IP, bind it. Enter the tracker's address, not your own, since the request arrives at Bybit from the tracker's infrastructure rather than from your handset. The key then persists and the problem goes away.

If it does not, put a recurring reminder in your calendar for eleven weeks out and treat key rotation as routine maintenance. Delete the old key on Bybit first, create the replacement, reconnect, and let the tracker resync. Revoking and rotating an API key covers the flow across venues.

There is a second-order benefit to either habit. A tracker that silently stops updating one venue does not just give you a wrong total, it gives you a wrong shape: your Bybit allocation frozen at April's prices while everything else moves. Allocation drift is hard enough to read when the data is current. If Bybit is one of several accounts you hold, the ninety-day check is a good moment to run the whole reconciliation rather than only this one, and the twenty-minute setup is the version of that job you can finish in an evening.