What is read-only access?
The permission model that lets software see your balances without touching them: key scopes on exchanges, the public address itself on chains.
Read-only access is the difference between showing someone your bank statement and handing them your card. The statement tells the whole story; the card can spend. Crypto has clean versions of this split on both of its rails, and knowing where the line sits is most of what security-conscious tracking means.
On exchanges: a permission on the key
Exchange API keys carry permissions chosen at creation: read, trade, withdraw. A read-only key answers questions, balances, history, open orders, and refuses commands. The enforcement lives on the exchange’s servers, not in the goodwill of whoever holds the key, which is why a leaked read-only key is an information problem and never a theft problem.
On chains: the address is the permission
Public blockchains publish every balance and transaction. Knowing an address means you can read its history; spending from it requires the private key, a different object entirely. Watch-only tracking simply uses the reading half: paste an address, see the wallet, touch nothing.
What read-only can never do
- Move funds, on any venue, under any circumstances. The capability does not exist on the credential.
- Approve tokens, sign messages or interact with contracts; those are signing operations, and there is nothing to sign with.
- Escalate itself. A read key cannot grant itself trade rights; permissions only change where you log in.
Why trackers should live here
A portfolio tracker needs to know things, not do things. Any tracker that asks for more than reading is carrying risk it does not need, and asking you to carry it too. TrueHold is built read-only end to end for exactly this reason: the worst case of a breach is that someone learns numbers, not that someone moves them.
Frequently asked questions
Is read-only access reversible?
Instantly. Delete the API key on the exchange and it is dead; stop watching an address and nothing was ever connected to begin with.
Can a read-only key leak my identity?
It exposes account data, balances and history, to whoever holds it. That is privacy exposure, worth revoking fast, but funds cannot move. Rotate keys you no longer use.
Why do some apps ask for trade permissions then?
Because they trade: bots, rebalancers, copy-trading tools need it. A pure tracker does not, and granting it to one is pure downside.
Terms in this article
See your whole portfolio in one view
Read-only by design. Paste a wallet, link an exchange, and watch every chain. Free to start.