How to track your crypto portfolio — the safe, read-only way

To track your crypto portfolio, connect each place you hold coins to one tracker using read-only access, then let it total everything for you. There are three ways to connect: a read-only exchange API key, a public wallet address (or xpub), and manual or CSV entry. The safe default is to prefer read-only keys and addresses over anything that can move funds, and to prefer manual entry whenever you would rather not share an account at all. This guide walks through each method and the order to do them in.

Before you connect anything, understand the one rule the diagram above illustrates: a read-only key can see your holdings but never move them, while a full-access key can trade and withdraw. Trackers only ever need the first kind.

The three ways to connect a tracker

Every tracker uses some mix of three connection methods, and it helps to know which you are using. A read-only API key is a special credential you create on an exchange that grants view-only access to your balances and history. A public address (or an xpub / extended public key for a whole wallet) lets a tracker read on-chain balances without any permission to spend. Manual or CSV entry means you type in, or upload a file of, what you hold — the tracker never touches your accounts at all.

• Read-only API key — best for exchange accounts you want auto-synced; view-only, no trading or withdrawal rights.
• Public address or xpub — best for wallets; the tracker reads the blockchain, which is public anyway, and can never spend.
• Manual or CSV — best for privacy or for assets a tracker cannot connect to; you stay fully in control of the data.

Connect an exchange with a read-only key, step by step

Connecting an exchange safely comes down to creating the right kind of key. On the exchange, open API settings, create a new key, and — this is the part that matters — leave trading and withdrawals switched off so only reading is allowed. Copy the key into your tracker, and if the exchange offers an IP allow-list, restrict the key to your tracker's addresses. Never tick a withdrawal permission for a tracker; nothing about tracking requires it.

1. In the exchange, go to API management and create a new API key.
2. Grant read-only / view permissions only. Explicitly disable trading, futures and withdrawals.
3. If offered, set an IP allow-list and a label so you can find and revoke the key later.
4. Paste the key and secret into the tracker; store nothing in plain text elsewhere.
5. Verify the tracker shows balances but has no move-funds option, then you are done.

Our deeper guide to connecting exchanges safely covers the exact wording each big exchange uses for these settings, plus how to revoke a key if you ever stop using a tracker.

Track wallets by address

For self-custody wallets, the safest connection is no connection at all — you add the public address and nothing else. Because a public address (or an xpub covering many addresses) only exposes information already written on the blockchain, a tracker reading it can display balances and history but has zero ability to spend. Copy the receiving address from your wallet, paste it into the tracker as a “watch” address, and the on-chain balance appears. This is the method to prefer for hardware and software wallets, since it never asks for a key of any kind.

Track DeFi positions and NFTs

DeFi and NFTs are tracked through the same public address you use for wallets, but coverage varies by tool. A tracker reads your address, identifies the protocols you have interacted with, and tries to value your liquidity positions, staked assets and collectibles. The better aggregators — CoinStats, Koinly, Rotki — do this well; others miss newer or smaller protocols. If your on-chain life is complex, test a tracker against a wallet you know well before trusting its totals. Our guide to tracking DeFi and NFTs goes through the quirks in detail.

Keep it private and safe

Tracking safely is mostly about limiting what you share and with whom. Use read-only keys and watch-only addresses so nothing you connect can move funds. Prefer a tracker whose privacy model you are comfortable with — a cloud aggregator sees everything you connect, while a local, open-source tool like Rotki keeps the data on your machine. Never enter a seed phrase or private key into any tracker; a real one never asks. And if a tracker ever requests withdrawal permission, treat it as a red flag and stop.

Common mistakes to avoid

Most tracking problems are self-inflicted and easy to sidestep. The direct answer: connect read-only, keep a private backup, and do not read the totals as advice.

• Creating a full-access API key “to be safe” — it is the opposite of safe; use read-only.
• Pasting a seed phrase into an app that asks for it — no legitimate tracker ever needs it.
• Trusting a tracker's number blindly — aggregators miss tokens; sanity-check against your accounts.
• Forgetting to revoke old keys when you stop using a tracker — leave no unused access live.
• Treating a green portfolio as a buy signal — a tracker reflects holdings, it does not advise.

When you are ready to choose a tool, see the best crypto portfolio trackers, compared.