Is It Safe to Connect an Exchange to a Portfolio Tracker? What a Read-Only API Key Can Do
· By Talu
A portfolio tracker needs to read your exchange account, and that means giving it an API key. It is fair to hesitate. A key with the read permission only cannot place an order or withdraw your funds. It can still reveal what you hold, so it is worth knowing where the real risk lies.
What is an API key?
An API key is an access your exchange creates for an outside program. It comes with a secret, and with permissions that you choose: read, trade, withdraw. The program can do what those permissions allow, and nothing else. A tracker only needs to read.
What a read-only key can and cannot do
- It can read your balances, your positions and your order history.
- It cannot place an order, move funds between accounts or withdraw.
So if a read-only key leaks, the damage is real but limited: someone learns what you hold and what you traded. They cannot take the funds with that key. They could use what they learn, though, for instance to write you a convincing scam message.
Where the risk really comes from
- A key with too many permissions. A key that can trade or withdraw is a different thing altogether. A tracker has no use for those rights.
- A fake site or a fake support message. The key is not the only thing people ask for. No tracker needs your private key, your recovery phrase or your exchange password.
- A breach at the tool itself. Any online service can be breached. That is why what you give it matters: a read-only key limits what a breach can expose.
How to create a safe key, in five steps
- Open the API page of your exchange, from its official site, and create a new key just for this tool.
- Tick read only. Leave trading, withdrawals, transfers and margin off.
- Name it after the tool, so you know later what to revoke.
- Paste the key and the secret into the tracker, on its real address.
- Once a year, or as soon as you stop using the tool, revoke the key on the exchange.
Exchanges help here to different degrees. Binance's guide, for one, says that a standard key with no IP restriction gets no permission other than reading, and that withdrawals require an IP restriction.
What Talu Crypt does with your key
- Binance, Bitfinex, Bybit, OKX and Coinbase: our server asks the exchange what the key can do. If it can trade, withdraw, transfer or use margin, it is refused and not stored.
- Kraken, Kraken Futures, MEXC and Bitpanda do not report a key's permissions, and Aster not always. The app tells you it could not check, so make sure you ticked read only.
- Storage: keys and secrets are encrypted before they reach the database. A saved key comes back to your browser masked, and the secret never does.
- The limit: Talu Crypt is built by one developer and has not been audited by a security firm. It is one more reason for the read-only rule.
The full list is on the security page.
Quick answers
Can a read-only key withdraw my crypto?
No. Withdrawing requires a permission that a read-only key does not have.
Should I revoke a key I no longer use?
Yes. It takes a minute on the exchange, and a key that no longer exists cannot leak.
Is there a way to follow my crypto with no key at all?
Yes. A wallet can be followed from its public address alone, and a coin can be added by hand with its quantity. An exchange balance entered by hand simply does not update on its own.
Try the demo, with no account and no key, to see what a tracker shows before you connect anything.