What is a read-only API key? Connecting an exchange to a portfolio app safely

An API key lets another app read your exchange account. Create read-only keys only, never enable trading or withdrawals, and watch for these scam signs.

An API key is a pair of codes (API Key + Secret Key, plus a Passphrase on some exchanges) issued by an exchange so another program can work with your account on your behalf. Each key has its own permissions: read-only, trading, withdrawals…

What a read-only key can do

• See balances, order history, and Spot / Funding / Earn wallets.
• It cannot place trades and cannot withdraw or transfer funds.

That is why portfolio apps only need read-only keys. If such a key leaks, someone can see your balances but cannot take your money.

How to create a read-only key

• Binance: Profile → API Management → Create API → leave only "Enable Reading".
• OKX: Profile → API → Create API key → choose only the "Read" permission, set a Passphrase.
• Bybit: Profile → API → Create new key → choose "Read-Only".
• Bitget, KuCoin: choose the "Read-only" / "General" permission, set a Passphrase.

Scam signs to avoid

• Anyone, or any "high-yield bot", asking for a key with trading or withdrawal permission — refuse straight away.
• People messaging you for your Secret Key "to check your account" or "to help". Exchange staff never ask for it.
• Fake sites that look like an exchange and ask you to paste a key. Only create keys on the exchange's real site.

On CoinXview

• Portfolio → Exchange accounts: connect Binance, OKX, Bybit, Bitget and KuCoin with a read-only key. Keys with trading or withdrawal permission are rejected automatically.
• Keys are stored only on your device; our server does not store them. When you no longer need it, tap "Remove" and delete the key on the exchange too.

This article is for general information only and is not investment advice.