Read-only API keys for portfolio trackers and tax tools: a safe setup for Singapore users

Keeping track of holdings spread across several exchanges is tedious, so many people connect a portfolio tracker or accounting tool that imports balances and history automatically. The connection usually works through an API key created on each exchange. A key that only reads data is low risk; a key that can trade or withdraw is a liability if the tool is ever compromised or turns out to be dishonest. Binance, OKX, Bybit and Bitget all let you choose permissions when creating a key. This guide explains how Singapore users can set up keys that give a tool exactly the access it needs to read records, keep those keys organised and revoke them without fuss when a tool is no longer used.

Choose the tool before creating any key

Evaluate the tracker or accounting service first. Check who operates it, how long it has existed, what it says about how keys are stored and whether it explicitly states that it only needs read access. Be wary of any tool that asks for trading or withdrawal permissions for a task that is only about reporting. If a tool offers file import as an alternative, consider exporting history from the exchange and uploading it instead, which avoids giving any ongoing access at all.

Create a key with read permission only

In the API management section of the exchange, create a new key and enable only the read or view permission. Leave trading, transfer and withdrawal permissions switched off. If the exchange allows IP restrictions and the tool publishes the addresses it connects from, add them. Give the key a name that identifies the tool and the date, such as the tool name followed by the month. Copy the secret straight into the tool's connection form and do not store it anywhere else unless you have a clear reason.

Use sub-accounts to limit what is visible

Read-only keys cannot move money, but they can reveal your balances and trading history. If you prefer a tool to see only part of your activity, create the key on a specific sub-account rather than the main account, where the exchange supports that. This also makes it easier to separate, for example, a long-term holding account from an active trading account in your reports. Check the exchange's help centre for how keys behave on sub-accounts.

Review and revoke on a schedule

Every few months, open the API section on each exchange and compare the list of keys with the tools you actually use. Delete keys for tools you have stopped using or no longer trust, and confirm that the remaining keys still have read permission only. If a tool announces a security incident, delete its keys immediately on every exchange and create new ones only once the issue is explained. A short list of keys, each with a clear name, makes this review quick.

Risk boundary: Singapore Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Check how a tracker stores keys and confirm it needs only read access before connecting it.
• Consider exporting history files for upload instead of granting any ongoing API access.
• Enable only the read permission and leave trading and withdrawal switched off.
• Name each key after the tool and the month so you can recognise it during reviews.
• Delete keys on every exchange as soon as a connected tool reports a security incident.