A read-only API key is the safest way to connect a portfolio tracker, trade journal or tax tool to your exchange account. It can see your balances and history but cannot place orders or move funds, so even if it leaks, it costs you nothing. Here's how to set one up correctly.
Why read-only is the safe default
Most tools that connect to your account only need to read it. A journal reads your fills, a tracker reads your balances, a tax tool reads your history. None of them need to trade or withdraw. By granting reading only, you remove the entire risk of a leaked key draining your account. This is the single most important habit in API security.
The universal rules
Whatever exchange you use:
- Enable reading only. Never enable trading or withdrawals for a tool that only needs to view data.
- IP-whitelist the key. A key bound to your specific IP is useless to an attacker from anywhere else.
- One key per app, deleted when unused.
- Store the secret in a password manager. It is shown once.
On the major venues
- [Binance](/go/binance): create the key in API Management, enable "Enable Reading" only, add IP restrictions, and leave withdrawals off. Steps in How to Create a Binance API Key.
- [Bybit](/go/bybit): create a System-generated key with read-only permission and an IP whitelist. Note that keys without an IP whitelist expire after 90 days. See How to Create a Bybit API Key.
- [Hyperliquid](/go/hyperliquid): often you don't need a key at all to track an address, since its public info API can return a wallet's positions and history. That's the safest option of all. See How to Set Up Hyperliquid API Access.
If you're not sure a tool is trustworthy
Give it a read-only key and nothing more. If a tool demands trading or withdrawal permission just to track your portfolio, that is a red flag. For the full security picture, read How to Keep Your API Keys Safe and, if the worst happens, Crypto Wallet Drained? What to Do.