How to Connect Exchanges to a Tracker Safely

Published Sep 21, 2026

To connect an exchange to a portfolio tracker safely, create a read-only (view-only) API key with trading and withdrawals disabled, restrict it to your tracker where possible, and paste it into the tracker and nowhere else. That is the whole safe method in one sentence, and getting it right matters more than which tracker you pick. This guide walks through the exact steps, the settings each major exchange uses, and how to keep the connection safe over time — including how to pull the plug cleanly if you ever stop using a tracker.

The safe method, step by step

The safe method is the same everywhere, even though the menus differ. Create a dedicated API key, give it read permission only, and paste it into your tracker. The single decision that makes it safe is refusing every permission except reading. If a step ever asks you to enable trading or withdrawals, stop — you have taken a wrong turn, because tracking needs neither.

Log in to the exchange and open API management (often under Settings, Security or Account).
Create a new API key and, when prompted, choose read-only or view permissions only.
Explicitly leave trading, futures and — most important — withdrawal permissions switched off.
If offered, add an IP allow-list restricting the key to your tracker, and give the key a clear label.
Copy the key and secret into the tracker; store no plain-text copy anywhere else.
Check that the tracker now shows balances but has no option to move funds.

Where the settings live on major exchanges

The wording varies, but the location is similar across the big exchanges. On Coinbase and Kraken you create API keys in the settings or security area and select permissions from a checklist — pick only the view or query balance options and leave anything mentioning trade, transfer or withdraw unchecked. Other major exchanges follow the same pattern: an API section, a new-key flow, and a set of permission toggles where read-only is one option among several. Whenever you are unsure what a permission does, the safe assumption is to leave it off; a tracker will still work with the minimum read access.

Some exchanges add extra safety you should use. IP allow-listing ties the key to specific addresses so a stolen key is useless elsewhere; key labels help you remember which app a key belongs to; and some exchanges auto-expire unused keys, which is a feature, not a bug. Turn these on where they exist.

A crucial distinction: trackers connect by API key, never by your exchange login, and no legitimate tracker will ever ask for your exchange password or two-factor codes. The API-key system exists precisely so you can grant limited access without handing over the keys to the kingdom. If an app asks you to log in to your exchange through it, or requests your password or authenticator codes, that is not a tracker connecting normally — it is a phishing pattern, and you should close it immediately.

A sensible order to connect your accounts

If you are connecting several accounts, a little order makes the process safer and less error-prone. Start with a single exchange and a read-only key, confirm the tracker shows the right balances and offers no way to move funds, and only then add the rest. Testing one connection end to end before you scale up means that if something looks wrong — a permission you did not expect, a request for a password — you catch it once rather than repeating a mistake across every account.

For self-custody wallets, prefer the address-only route over any key, since a public watch address exposes nothing that can be spent and needs no permissions at all. In practice that means exchanges connect by read-only API key and wallets connect by public address, which is the safest combination and the one every reputable tracker supports. Add accounts gradually, label each connection, and stop the moment anything asks for more access than viewing.

Keeping the connection safe over time

A connection is not set-and-forget. Review your active API keys every few months and delete any belonging to tools you no longer use, because an unused key with live read access is needless exposure. If you stop using a tracker, revoke its key on the exchange rather than only deleting the app — deleting the app does not remove the access you granted. And if you ever suspect a key has leaked, revoke it and create a fresh one; because it is read-only, the worst case is a privacy scare rather than a loss, which is exactly why the read-only rule matters.

With the connection settled, you can choose a tool from our best crypto portfolio trackers, and the deeper background on key permissions is in read-only API keys explained.

Connecting exchanges — questions

Is it safe to connect an exchange to a portfolio tracker?

Yes, if you connect with a read-only API key that has trading and withdrawals disabled. Set up that way, the tracker can see your balances but can never move funds, so even a breach cannot cost you money. The remaining risk is privacy — the tracker sees what you hold — not theft.

Will a tracker ask for my exchange password?

No. Legitimate trackers connect by API key, not by your login, and none will ask for your exchange password or two-factor codes. If an app requests those, it is a phishing attempt — close it. The API-key system exists so you can grant limited, read-only access without sharing your credentials.

How do I disconnect a tracker from my exchange?

Revoke the API key on the exchange, not just in the app. Open API management, find the key you gave the tracker (this is why labels help), and delete it. That removes the access entirely; deleting the tracker app alone leaves the key — and its read access — live on the exchange.

Should I use an IP allow-list?

If your exchange offers one, yes. An IP allow-list ties the API key to specific addresses, so even if the key leaked it would be useless from anywhere else. It is an easy extra layer on top of read-only permissions and costs you nothing but a minute of setup.

Do all exchanges support read-only API keys?

The major ones do — read-only permission is a standard part of the API-key system on established exchanges. If an exchange offers no way to create a view-only key, that is a reason for caution; consider tracking that account by manual entry instead, so you never grant more access than you are comfortable with.

Can I connect one exchange to more than one tracker?

Yes, and the clean way to do it is a separate read-only key for each tracker. That lets you revoke one connection without affecting the others and makes it obvious which app has which access. Reusing a single key across several apps works but is harder to manage and riskier if that key ever leaks.

Ready to pick a tracker? See the best crypto portfolio trackers, compared, or read how to track your portfolio safely with read-only keys.