Custodial vs non-custodial trackers: what the app can actually do
A tracker does not hold your coins, but what it can do with what you give it varies enormously. The four access levels, and what each one risks.
We build a tracker, so read this with the bias declared. "Non-custodial" has become a word every portfolio app puts on its homepage, and it has stopped meaning much, because a tracker holding nothing can still be handed the means to move everything. The useful question is not whether an app custodies your assets. It is what it asked you for, and what that thing can do if it leaks.
Four levels of access
Almost every portfolio app sits at one of these. The label on the marketing page rarely tells you which.
A public address or xpub
What it can do
Read balances and history
Worst case if the app is breached
Your holdings are known. Nothing can move.
A read-only exchange API key
What it can do
Read balances, trades and positions
Worst case if the app is breached
Your holdings are known. Nothing can move or be withdrawn.
An API key with trading rights
What it can do
Read, and place orders
Worst case if the app is breached
Your book can be traded against you, though funds cannot leave.
A seed phrase or private key
What it can do
Everything you can do
Worst case if the app is breached
The wallet is gone.
| What it asks for | What it can do | Worst case if the app is breached |
|---|---|---|
| A public address or xpub | Read balances and history | Your holdings are known. Nothing can move. |
| A read-only exchange API key | Read balances, trades and positions | Your holdings are known. Nothing can move or be withdrawn. |
| An API key with trading rights | Read, and place orders | Your book can be traded against you, though funds cannot leave. |
| A seed phrase or private key | Everything you can do | The wallet is gone. |
The first two lines are the ones worth using. The gap between line two and line three is the whole argument: a key that cannot withdraw turns a breach from a theft into a privacy problem, and privacy problems do not end with an empty wallet.
Where custody actually sits
Custody is about who can move an asset, and on that question a tracker is usually irrelevant: your coins sit in your wallet or on the exchange where you left them, and that is where custody lives. What the tracker holds is a copy of the picture. That copy is worth protecting too, because a full map of what you own and where is exactly what a targeted attack begins with, but it is a different risk from losing the coins, and the two get muddled by the same word.
What to check before connecting
- Does the exchange offer a key with trading and withdrawal switched off? If so, create it that way rather than trusting the app to ignore the rights.
- Can you restrict the key to the app’s IP addresses? Most major exchanges allow it and it costs nothing.
- Does the app explain what it stores, and can you revoke access from the exchange without asking the app?
- Does it ever ask for a seed phrase, a private key, or a signature that approves spending? Any of the three ends the evaluation.
The mechanics per venue are in read-only API keys on 20 exchanges, and the case for keys that cannot move funds is in are read-only API keys safe. If you already connected something and are not sure what it can do, audit your exchange access walks through checking and revoking.
The honest trade-off
Read-only access buys safety and costs convenience: the app can show you everything and change nothing, so rebalancing, trading and withdrawing all stay where they were. That is the right trade for a tool whose job is to tell you the truth about what you own. It is worth saying plainly that it is a trade, not a free lunch, and that an app promising both is promising to hold rights it says it will not use.
Frequently asked questions
Is a portfolio tracker custodial?
Almost never in the sense that matters: your coins stay in your wallet or on your exchange. What varies is the access the tracker asked for, and a key with withdrawal rights is a custody question wearing a different name.
Can a tracker steal my crypto with a read-only API key?
No. A key created without trading and withdrawal rights can read balances and history and do nothing else. The exchange enforces that, not the app.
Is it safe to give a tracker my wallet address?
Yes, in the sense that nothing can move: an address is public by design and is already visible on the chain. It is not private, though, and anyone holding it can see your full history.
Why would a tracker ask for a seed phrase?
There is no legitimate reason. Reading a balance needs public data only. Treat the request itself as the answer and close the page.
What is the difference between non-custodial and read-only?
Non-custodial says the app does not hold your assets. Read-only says it cannot move them either. The second is the stronger claim, and the one worth checking.
Terms in this article
See your whole portfolio in one view
TrueHold is an AI-native financial and DeFi platform for modern capital. Paste a wallet or link an exchange to see every chain in one view, free.
Open TrueHold →Keep reading
Sep 5, 2026 · 5 min read
Read-only API keys on OKX, Kraken and Coinbase, step by step
Where the read-only permission lives on OKX, Kraken and Coinbase, what to leave unticked, IP allowlists, key expiry, and what to paste into a tracker.
Sep 1, 2026 · 3 min read
Audit yourself: what apps can touch your exchange account
Every API key you ever created is still there until you delete it. A ten-minute audit per exchange finds the forgotten ones and closes them.