What is Read-only API key?

A read-only API key is a credential an exchange issues that lets software see an account without being able to act on it. It can fetch balances, positions, order history and transfers; it cannot place an order, cancel one, move funds between accounts or withdraw. Every major exchange offers this scope under its own name, from Binance’s “Enable Reading” to Gemini’s “Auditor” role, and on several of them it is the default for a new key.

The permission model matters more than the name. An exchange key is created with a set of scopes, and the scopes are enforced by the exchange, not by the software that holds the key. A tracker holding a read-only key is therefore incapable of trading even if the tracker itself is compromised, because the exchange will refuse the request. This is the whole argument for read-only tracking: the worst case of a leaked key is that someone sees your balances, not that they move them.

Two details separate a careful setup from a careless one. First, the IP allowlist: most exchanges let a key be restricted to a list of addresses, which turns a leaked key into one that works from nowhere else, and on several exchanges also removes the expiry clock that applies to unrestricted keys. Second, one key per tool, named after the tool, so that revoking a service you stopped using never breaks another one.

TrueHold connects every exchange with a read-only key and nothing more. The key is stored encrypted, used to read balances and history on a schedule, and stops working the moment you revoke it on the exchange. The exchange coverage pages on this site show the exact permission to tick for each venue, and the 20-exchange table in the blog compares how each one handles allowlists and expiry.