Kraken Gives You Ten Permission Boxes. A Tracker Needs Four.

Most exchanges offer a permission called something like "read" and leave it there. Kraken splits the same idea into individually tickable capabilities grouped under Funds, Orders & Trades, and Data, then adds fields for expiry, historical range and a timing tolerance almost nobody understands on first sight.

The granularity is a feature. It means you can hand a portfolio tracker a credential narrow enough that even a total compromise of the app tells an attacker nothing except what you own. The cost is that the screen looks intimidating, so people tick everything or give up. Here is the short version, then the reasoning.

Where does the key screen live?

Sign in to Kraken Pro. Click the human icon in the upper right, choose Settings, open the API tab, then Create API key.

Give the key a name that identifies the app receiving it. Kraken requires the name to be unique across your keys, which is a small nudge toward good hygiene and worth taking seriously the day you have five of them.

When you generate, Kraken shows an API key and a Private key, plus a QR code. The naming trips people up. Kraken's "private key" is the API secret used to sign requests to your Kraken account. It is not a blockchain private key, it does not control a wallet, and it has no relationship to a seed phrase. Treat it like a password anyway. It is displayed once and cannot be retrieved from API Key Management afterwards.

Which boxes does a tracker actually need?

Four, and no more.

1. Query Funds, under Funds. This returns your account balances. Without it there is no connection worth having.
2. Query Open Orders & Trades, under Orders & Trades. Anything resting on the book that has not filled.
3. Query Closed Orders & Trades, under Orders & Trades. Your fill history, which is what a tracker uses to reconstruct cost basis rather than guessing at it.
4. Query Ledger Entries, under Data. Deposits, withdrawals, transfers, staking rewards, fees. This is the layer that makes a Kraken history make sense instead of appearing as a set of unexplained balance changes.

Export Data, also under Data, is optional. Grant it if you want the tracker to pull bulk history for a tax or reconciliation pass; leave it off otherwise. Exporting your data covers when this matters.

Everything else stays unticked. Deposit Funds and Withdraw Funds are the two that can actually move value, and no tracker has any use for either. Modify Orders and Cancel/Close Orders belong to trading bots. A key holding only query permissions is refused by Kraken the instant it attempts anything else, because the permission check happens at Kraken's edge on every signed request rather than inside the app you gave the key to. Read-only API keys sets out why that distinction is the entire security argument, and is it safe to connect an exchange puts numbers around what remains at risk.

What are the odd fields for?

Three of them are worth understanding rather than skipping.

Key expiration. Kraken lets you set a date after which the key stops working. Almost no other major exchange offers this as a user-controlled field. It converts key rotation from a discipline you have to remember into a deadline you cannot avoid. Twelve months is a sensible setting; put a reminder in your calendar a week before, because when it lapses the tracker will simply report a broken connection with no explanation.

Query start and end date/time. These cap how far back and how far forward the key can read your history. If you only want a tracker to see the current tax year, set the start date accordingly. Leave both blank when you want the full history imported, which is usually what you want on a first connection.

Nonce window. Every request Kraken accepts carries a counter that must always increase, and requests arriving out of sequence are rejected as replays. If two processes share one key, or your network reorders packets, you get intermittent authentication failures that look like a broken secret. The nonce window, adjustable from one to ten seconds, tells Kraken to tolerate the reordering. Leave it at zero for a single tracker. If failures appear later, raise it to five before you assume the key is bad.

IP address restriction works the way it does elsewhere: enter the tracker's published server address, never your own. A query to Kraken leaves the tracker's infrastructure, not your phone, so allowlisting your home connection silently blocks every request.

Why does my ETH appear twice?

Because Kraken encodes an asset's state into its ticker rather than into a separate field.

A code ending in .S is an onchain staked balance, so ETH.S is staked ether. A code ending in .M is an opt-in rewards balance, so BTC.M is bitcoin earning a yield. A code ending in .P is bonded to a parachain, which is where DOT.P comes from. Kraken has migrated accounts onto these codes in batches over time, so the suffixes may have appeared without you doing anything.

To a tracker that maps the suffix, ETH and ETH.S collapse into one ETH line with the staked portion noted. To one that doesn't, ETH.S is either an unknown asset with no price or a separate holding sitting oddly beside your ETH. Neither is a wrong balance. It is a labelling question, and it matters because you can otherwise convince yourself half your ether has gone missing. Tracking staked assets covers the broader pattern across venues.

What does a Kraken key not reach?

Kraken Futures is the main one. It runs as a separate platform with separate credentials, and a Kraken Pro key returns nothing from it. Hold collateral there and it needs its own connection.

Subaccounts, where you have them, each need their own key. So does a second Kraken entity if you hold under more than one regional arm.

And Kraken's ledger is unusually good at telling you what happened, which makes it unusually good at exposing what a tracker got wrong. Once the connection is live, compare your realised gain in the tracker against Kraken's own ledger export for a quarter you can check by hand. Realised versus unrealised profit explains why the two figures answer different questions, and auditing your tracker is the method for proving a number rather than hoping it is right.

Do that once, properly, on the venue with the cleanest history, and you gain something worth more than an accurate Kraken balance: a reference point you can hold every other connection against.