Safety brief
API Keys and Third-Party Trading Tools
Bots, trackers and tax tools all ask for exchange API keys. What each permission actually grants, and the one you should almost never hand over.
Portfolio trackers, trading bots, copy-trading services and tax tools all want to connect to your exchange account, and the usual mechanism is an API key: a credential you generate inside the exchange that lets software act on the account without your password. Using one is reasonable. It is also a standing grant of access that outlives most of the assumptions people make about it.
Permissions are separate rights
Exchanges generally split API access into distinct permissions — read, trade and withdraw is the common division, though the names and the granularity vary by venue. Read exposes balances and history. Trade can place and cancel orders. Withdraw can move assets off the exchange. They are independent of one another: a key can read without trading, and trade without withdrawing.
The rule that follows
Almost nothing needs withdrawal permission. A tracker needs read. A tax tool needs read. A bot needs read and trade. If a service asks for withdrawal rights, ask what specifically it does with them, and treat the absence of a clear answer as the answer. Where the exchange offers it, restrict the key to the IP addresses the service publishes, which makes a stolen key useless from anywhere else, and set an expiry if that option exists.
What a key survives
Changing your account password does not disable a key that has already been issued, and on many venues neither does adding two-factor authentication. A key stays valid until it is deleted or expires. That property is what turns an abandoned integration into an open door: the service you tried once two years ago may still hold working access, and that service's own security is now part of yours.
Housekeeping that actually helps
Generate one key per service rather than reusing a single key everywhere, keep a note of what each is for, and delete keys when you stop using the tool instead of leaving them dormant. Exchanges show the creation date and often the last-used time for every key — an unfamiliar key, or a familiar one showing activity when you are not trading, is worth acting on immediately.
Key takeaway
The limits of the whole arrangement
A read-only key still discloses your full balance and trading history to whoever holds it, which is exactly the information useful to anyone targeting you. A trade-only key cannot withdraw, but it can still cost you money: an attacker holding trade rights can push your balance into a thin market against their own orders. Least privilege reduces the damage. It does not remove it.
More guides
Next