Read-only API keys: create one on Binance, Kraken and OKX, and check it can’t trade or withdraw

Creating an API key on Binance, Kraken or OKX takes two minutes. The real question is different: is my key really read-only? I’ve created read keys on my own three accounts, and two of them were rejected the first time, for reasons that weren’t obvious.

What is an API key?

An API key is access to your account reserved for software. It has two parts: the key, which says who you are, and the secret, which proves it. Unlike a password, it only carries the permissions you give it.

If stolen, a read-only key would expose your history and balances, but it couldn’t be used to sell or withdraw.

Three rules before you create a key

• One key per tool. You can delete it without breaking anything else, and Kraken rejects a key used by two programs at once.
• Read only. If a portfolio tracker asks for trading or withdrawal permission, it isn’t a portfolio tracker.
• Copy the secret right away. Exchanges usually show it only once.

Create a read-only API key on Binance

Turn on two-factor authentication and get your identity verified first.

1. On the website, profile icon, then Account › API Management › Create API.
2. Choose a System generated key, the type most portfolio trackers ask for.
3. Name it, then confirm with your security codes.
4. Copy the API key and the secret key.
5. In Edit restrictions, only “Enable Reading” should be ticked.

In the mobile app: More › Services, then API Management.

According to Binance’s documentation, a system-generated key with unrestricted IP access can only carry the read permission. Withdrawals require an IP restriction: without one, the box can’t even be ticked.

On Kraken: one permission, “Query ledger entries”

Create the key on kraken.com, in a browser: the mobile app can’t do it.

1. Profile icon, Settings, the API section, then Create API key.
2. Name the key.
3. In the Data column, tick “Query ledger entries”. Nothing else.
4. Don’t add two-factor authentication to the key: a tool that runs on its own can’t type in a code.
5. Copy the API key and the private key in full, including the final “=”.

That one permission is enough: the ledger holds everything, staking included, back to the day the account was opened. Kraken’s help page explains each box.

That’s where I was rejected the first time: my key had other query permissions, just not that one, and Kraken answered “Permission denied”.

On OKX: the passphrase and the three-entity trap

1. On the website, Profile › API, then Create API key. In the app: Menu › API › Create API key.
2. Name the key and tick only the “Read” permission.
3. Choose a passphrase, a password separate from the API secret. OKX never shows it again: lose it and the key has to be recreated.
4. Copy the key and the secret.

“API key doesn’t exist”: a key created at OKX Europe

OKX has three entities, each with its own address: global, European (EEA) and US. A key only exists in the entity where your account was opened. Queried anywhere else, it answers “API key doesn’t exist” (error 50119), as OKX’s API FAQ explains.

That’s what happened to me: my account is with OKX’s European entity, and the global address rejected my perfectly valid key. Recreating the key achieves nothing. Check instead that the tool is querying the right entity, which Crypto Master does on its own. If no entity knows the key, it was deleted, or created in “Demo trading” mode.

Check that a key can’t trade or withdraw

Check the key once, before pasting it anywhere.

• In your list of keys, it shows only read permissions: nothing about withdrawals, transfers, trading or orders.
• You received the exchange’s email announcing its creation. A key you didn’t create yourself gets deleted on the spot.
• Its name says which tool it’s for.

Don’t “test” it by attempting a withdrawal from some other software: you’d be handing it to one more tool. An extra permission? Delete the key and create a new one, rather than unticking it.

Should you restrict the key to an IP address?

All three exchanges let you limit a key to the IP address of the tool’s server. That’s an extra layer if the key leaks, not a necessity for a read-only key.

Crypto Master always queries from the same address, which the screen where you paste the key gives you. A key restricted to another address is rejected (“Invalid IP” at OKX).

The most common error messages

What Crypto Master does with your key

Crypto Master connects to Binance, Kraken, OKX, Coinbase, Bybit, Gate, MEXC, KuCoin, Robinhood, Crypto.com Exchange and Bitget with a read-only key. Rather skip the key altogether? For Kraken and Binance, the history export is enough, into the same account: Kraken’s “Ledgers” export, and Binance’s files just as they download, ZIP included.

• It’s used to read your history. The software contains no call that places an order or withdraws funds, and an automated test checks that.
• It’s encrypted (AES-256), with an encryption key kept outside the database. The server decrypts it to query the exchange, which is why read-only matters.
• It’s never shown back to you, except its last four characters.
• It can be removed in one click, in Crypto Master or at the exchange. What’s already imported stays.

OKX’s API only returns 90 days of trades. Older history comes in through its export files, into the same account. Everything is detailed on the Security page. The free plan covers 3 connected accounts and 500 transactions (pricing).

Frequently asked questions

Share: LinkedIn X Facebook