How read-only API keys work, and why they can’t move your funds
Every exchange key comes with permission scopes. Understand the three tiers and you know why a read-only tracker can see balances but never touch them.
Connecting an exchange account to anything feels dangerous, and the instinct is healthy. But exchange API keys are not all-or-nothing. Every major venue issues keys with permission scopes, and the difference between the scopes is the difference between "someone can look at my statement" and "someone can drain my account."
What an API key actually is
An API key is a credential your exchange generates so software can talk to your account without your password. When you create one (on Binance, OKX, Coinbase, Bybit, Kraken, anywhere), the exchange asks which permissions the key should carry. That choice is enforced server-side by the exchange itself: a key without a permission physically cannot perform the action, no matter what software holds it.
The three permission tiers
- Read: see balances, positions, and trade history. Nothing more.
- Trade: place and cancel orders with the funds inside the account.
- Withdraw: send assets out of the account. The dangerous one.
These tiers are independent checkboxes, and the default for a new key on every major exchange is read-only. A tracker only ever needs the first tier. There is no legitimate reason for a portfolio tool to request trade access, and absolutely none to request withdrawal access.
Why read-only can’t hurt you
A read-only key cannot sign orders, cannot touch withdrawal endpoints, and cannot change account settings. The worst-case scenario if one leaks is that someone sees your balances. Unpleasant, but fully recoverable: you delete the key and the view goes dark. Compare that with a leaked withdrawal-enabled key, where the worst case is an empty account.
Keeping keys clean
- Create a separate key per app, so revoking one never breaks another.
- Never grant trade or withdraw scopes to a tracking tool: decline and leave if one asks.
- Create keys only on the exchange’s official API page, never through a link someone sent you.
- Prune keys you no longer use; a key you forgot is a key you can’t audit.
What TrueHold does with your key
TrueHold accepts read-only keys only. It uses them to read balances and history, totals your positions next to your wallets, DeFi and perps, and computes P&L, and that is the entire relationship. You can revoke access at any moment, either in TrueHold or by deleting the key on the exchange that issued it.
Frequently asked questions
Can a read-only API key be used to steal my funds?
No. The exchange enforces permissions on its own servers, and a read-only key has no ability to trade or withdraw. The worst case if it leaks is that someone sees your balances, and revoking the key ends even that.
Which permissions should I enable for a portfolio tracker?
Read only. Leave trading and withdrawal permissions unchecked. Any tracking tool that asks for more than read access should be treated as a red flag. For Binance specifically, here is the step-by-step walkthrough.
How do I revoke a tracker’s access?
Delete the key in your exchange’s API settings, or remove the connection inside the tracker. Either way access ends immediately, because the key is the only bridge between the two.
Terms in this article
See your whole portfolio in one view
Read-only by design. Paste a wallet, link an exchange, and watch every chain. Free to start.