Why a Read-Only API Key Still Feels Dangerous — What the Exchange Permission Screen Doesn't Tell You

The sentence we hear most when walking people through an exchange connection is "I don't like handing over a key, even a read-only one." We think that worry is reasonable. An exchange's API page lists checkboxes such as "read," "trade," "withdraw," and nowhere does it say what a stranger could do with each one turned on. This column fills in that blank. It is not a reassurance piece. It is a list of what is locked and what is not.

At a glance

• Exchange API permissions come in three layers — read, trade, withdraw — and a key with only read enabled can view balances and fills but cannot place orders or move funds. IP binding is the second lock.
• Satoshi Note (TokenPost's free crypto portfolio tracker, read-only API sync with 18 exchanges) tests a key before saving it, refuses keys with withdrawal enabled, and stores keys encrypted with AES-256-GCM, with the decryption key kept only in the server environment.
• The limits that remain — exchanges never explain their checkboxes, and no service can rule out its own incident — are stated, not hidden. Three questions to ask any service are listed at the end.

Permissions come in three layers

Names differ from exchange to exchange, but API permissions always reduce to three layers.

There is exactly one door through which money leaves an account: the withdraw permission. A leaked read-only key lets someone look at your balance, and that is where it stops. That is not nothing; your balance being visible is a data leak in its own right, which is why the second lock below matters. But "if I hand over a key I could lose my money" and "if I hand over a key someone could see my balance" are worries of very different sizes, and a single checkbox separates them.

IP binding is the second lock

Some exchanges, Upbit and Bithumb among them, require an IP address when a key is created. Any call made with that key from a different IP is rejected. It looks like bureaucracy, but it nearly erases the leak risk of a read key: even if the key gets out, it cannot read anything from anywhere else.

Satoshi Note does not call exchanges from your phone. Our server does it on your behalf, which is why the connection screen shows "IP address to register at the exchange" with a copy button, and the guide asks you to register that server IP. On exchanges where an unregistered IP is blocked outright, this step is mandatory.

What we do when we receive a key

Satoshi Note only reads, so our rule is that a key with withdraw permission is not accepted. The "Test before saving" button on the connection screen is what enforces that rule.

1. Without saving the key, we read your balance (or recent trades) once to confirm the key works.
2. On exchanges that report permissions through the API (Binance, Bybit, Bitget, Coinbase), we ask whether trade or withdraw is enabled. If withdraw is on, the screen locks the save button. Trade permission does not block saving, but we tell you to turn it off.
3. On exchanges that cannot report permissions (Upbit, Bithumb and others), you must tick "Read-only permissions only (withdraw and trade off)" before the key can be saved.

Stored keys are encrypted on the server with AES-256-GCM, and the encryption key lives in the server's environment configuration, not in the database. Disconnecting deletes the row.

What remains

That is what we do. Here is what we cannot do.

• On exchanges that cannot report permissions, we rely on your word, the checkbox. If someone ticks it and pastes a key with withdraw enabled anyway, we have no way of knowing.
• The encryption key and the ciphertext sit on the same server. If the server is fully compromised, encryption does not stop everything. That is why "withdraw-free keys only" is the first line of defense, ahead of encryption.
• Permission names vary (asset inquiry, balance read, Read), and some exchanges require order-side permissions just to read fills. Our guide says which boxes to tick per exchange, but when an exchange redesigns its page the guide can lag behind.

Three questions to ask any service

Before pasting a key into any portfolio service, including ours, we suggest checking three things.

1. Does it work without withdraw permission? A "portfolio" service that needs withdraw is not a portfolio service.
2. On exchanges that support IP binding, does it tell you the IP to register?
3. Does it refuse a key that has withdraw enabled, or does it simply accept whatever you paste?

The third one says the most about a service's attitude. A service that deliberately declines permissions it could have taken, and one that takes whatever it is given, end up in very different places when something goes wrong.

FAQ

Can a read-only API key be used to withdraw my coins?

No. A key with only read permission can fetch balances and trade history; orders and withdrawals are blocked by the exchange at the permission layer. Even a leaked read-only key can do no more than look at your balance.

What does Satoshi Note do with a key it receives?

It sends a read request to the exchange to test the key before saving, and refuses any key that has withdrawal enabled. Keys that pass are stored encrypted with AES-256-GCM; the decryption key lives only in the server environment.

What should I ask any service before handing over a key?

Three things: does it refuse keys with withdrawal enabled, how and where does it encrypt the key, and which IP does it tell you to whitelist. If any of the three has no answer, do not enter the key.

---

This is a column: the Satoshi Note team's view, not a recommendation of any exchange or service. Which permissions to enable on each exchange is listed on the exchange cards under Settings › Connect exchanges and in the exchange connection guide.