How to track Bybit without granting withdrawal rights

The right amount of trust to extend a portfolio tracker is: enough to read your balances, not enough to touch them. Bybit’s API permission system makes that split explicit. A key created as read-only can see the account and can do nothing to it, and the exchange enforces that server-side, not on the honor system.

Create the key, keep the rights

• In Bybit, open API management and create a new key. Choose system-generated, which is the standard API key type.
• Set permissions to Read-Only. This is the entire trick: a read-only key has no trade, transfer or withdrawal capability to abuse.
• Skip IP restrictions or set them if you prefer; read-only stays read-only either way.
• Copy the key and secret into your tracker. Bybit shows the secret once, so paste it before closing the page.

What the unified account hides

Bybit’s unified trading account blends spot and derivatives margin into one pool, which is convenient for trading and slippery for accounting. Collateral backs perp positions while also being your spot balance; funding drips in and out; a position’s effective leverage drifts as equity moves. Checking the app twice a day does not keep up with any of that. Continuous reading does.

The numbers worth watching

• Total equity across the unified account, the number the tabs are hiding.
• Open positions with liquidation distance, because that is the number that matters at 3am.
• Funding paid and received per position, the quiet tax on held perps.
• Realized PnL from closed trades, which is what tax season eventually asks about.

Reading it in TrueHold

TrueHold connects to Bybit directly with the read-only key and keeps the whole account in view: unified balances, positions and history, normalized next to your Hyperliquid and Lighter books, your other exchanges and your wallets. One exposure number, one PnL definition, and a key that could not move funds if it tried.

Terms in this article