Read-only API keys explained: how to connect an exchange safely
What an exchange API key is, what read-only means, which permissions to switch off, and the checks to do before you paste a key into any app.
LedgerVault team · · 5 min readApps that track your crypto usually ask for an API key from your exchange. That can sound risky: you're handing an app a key to your account. Set up properly, though, a key can be limited so it only lets the app look, never act. Here's how that works.
What an API key is
An API key is a pair of codes your exchange creates for you: a key (like a username) and a secret (like a password). An app uses them to ask the exchange for information on your behalf, such as your balances, without ever knowing your login or password.
Permissions decide what a key can do
When you create a key, the exchange asks what it's allowed to do. The names differ between exchanges, but they usually fall into three groups:
| Permission | What it allows | For a tracker |
|---|---|---|
| Read / view | See balances, holdings and history | On |
| Trade | Place and cancel orders | Off |
| Withdraw / transfer | Move funds out of your account | Off |
A read-only key has only the first one switched on. Even if someone else got hold of it, they could see your balances but couldn't trade or move anything.
How to create a read-only key
- Log in to your exchange and open the API section (usually under account or security settings).
- Create a new key and give it a name you'll recognise, like "Net worth tracker".
- Tick read or view only. Make sure trading and withdrawals are switched off.
- If the exchange offers an IP allow-list and the app gives you its addresses, add them.
- Copy the key and secret straight into the app. Don't save them in notes, emails or screenshots.
Checks before you trust any app with a key
- It asks for read-only. A tracker has no reason to need trading or withdrawal rights.
- It explains how keys are stored. Look for encryption and a clear privacy policy.
- You can revoke it any time. Deleting the key on the exchange cuts off access straight away, whatever the app does.
- It never asks for your exchange password or 2FA codes. An API key replaces those; it doesn't need them.
Good habits
- Use one key per app, so you can revoke one without affecting the others.
- Review your keys every few months and delete the ones you no longer use.
- Keep 2FA switched on for your exchange account, whatever keys you create.
How LedgerVault uses keys
LedgerVault only needs read access. You connect an exchange with a read-only API key, and it can see balances but never trade, transfer or withdraw. Everything it reads is encrypted end to end. More on that on our security page.