How read-only API keys work, and why they can’t move your funds
Every exchange key comes with permission scopes. Understand the three tiers and you know why a read-only tracker can see balances but never touch them.
Connecting an exchange account to anything feels dangerous, and the instinct is healthy. But exchange API keys are not all-or-nothing. Every major venue issues keys with permission scopes, and the difference between the scopes is the difference between "someone can look at my statement" and "someone can drain my account."
What an API key actually is
An API key is a credential your exchange generates so software can talk to your account without your password. When you create one (on Binance, OKX, Coinbase, Bybit, Kraken, anywhere), the exchange asks which permissions the key should carry. That choice is enforced server-side by the exchange itself: a key without a permission physically cannot perform the action, no matter what software holds it.
The three permission tiers
- Read: see balances, positions, and trade history. Nothing more.
- Trade: place and cancel orders with the funds inside the account.
- Withdraw: send assets out of the account. The dangerous one.
These tiers are independent checkboxes, and on many major exchanges a new key starts with read access only. A tracker only ever needs the first tier. A tool that only tracks has no need for trade access, and even less for withdrawal access.
Why read-only can’t move your funds
A read-only key cannot sign orders, cannot touch withdrawal endpoints, and cannot change account settings. The worst-case scenario if one leaks is that someone sees your balances. Unpleasant, and a real privacy loss, but containable: you delete the key and the view goes dark. Compare that with a leaked withdrawal-enabled key, where the worst case is an empty account.
Keeping keys clean
- Create a separate key per app, so revoking one never breaks another.
- Never grant trade or withdraw scopes to a tracking tool: decline and leave if one asks.
- Create keys only on the exchange’s official API page, never through a link someone sent you.
- Prune keys you no longer use; a key you forgot is a key you can’t audit.
What TrueHold does with your key
TrueHold asks for read-only keys only. It stores them encrypted on its servers and uses them to read balances and history, totals your positions next to your wallets, DeFi and perps, and computes P&L, and that is the entire relationship. You can revoke access at any moment, either in TrueHold or by deleting the key on the exchange that issued it.
Frequently asked questions
Can a read-only API key be used to steal my funds?
No. The exchange enforces permissions on its own servers, and a read-only key has no ability to trade or withdraw. The worst case if it leaks is that someone sees your balances and history, a privacy problem rather than a loss of funds, and revoking the key stops further access.
Which permissions should I enable for a portfolio tracker?
Read only. Leave trading and withdrawal permissions unchecked. Any tracking tool that asks for more than read access should be treated as a red flag. For Binance specifically, here is the step-by-step walkthrough.
How do I revoke a tracker’s access?
Delete the key in your exchange’s API settings, or remove the connection inside the tracker. Deleting the key on the exchange ends access for certain, and removing the connection stops the tracker from using it, because the key is the only bridge between the two.
Terms in this article
See your whole portfolio in one view
TrueHold is an AI-native financial and DeFi platform for modern capital. Paste a wallet or link an exchange to see every chain in one view, free.
Open TrueHold →Keep reading
Sep 21, 2026 · 4 min read
Custodial vs non-custodial trackers: what the app can actually do
A tracker does not hold your coins, but what it can do with what you give it varies enormously. The four access levels, and what each one risks.
Sep 8, 2026 · 5 min read
Read-only API keys on OKX, Kraken and Coinbase, step by step
Where the read-only permission lives on OKX, Kraken and Coinbase, what to leave unticked, IP allowlists, key expiry, and what to paste into a tracker.