What a portfolio tracker should never ask you for

Reading a balance and moving a balance need completely different permissions. A tool that only shows you numbers needs the first and never the second, and the difference is easy to check before you hand anything over.

Never a seed phrase, never a private key

A seed phrase reconstructs every key in your wallet. A private key signs anything, including a transfer of everything the address holds. Neither is required to read a balance, because balances on a public chain are public: anyone with your address can look them up, which is what a block explorer is.

So the rule is absolute rather than a matter of degree. There is no legitimate portfolio-tracking reason to be asked for a seed phrase or a private key, and no amount of assurance about how it will be stored makes the request reasonable. A product that asks has told you what it is.

Exchange keys: read, and nothing else

Exchange balances are not public, so reading them does need a credential. Every major exchange lets you create an API key with permissions attached, and the one you create for a tracker should be able to do exactly one thing: report what the account holds.

• Enable reading balances only. The permission is usually called "read", "read-only", or on Kraken specifically, "Query Funds".
• Leave trading disabled. A tracker never needs to place an order.
• Leave withdrawals disabled. This is the one that matters most — a key without it cannot move money off the exchange no matter who ends up holding it.
• Where the exchange offers it, restrict the key to an IP address.
• Give it a name you will recognise later, so revoking the right key is easy.

Some venues add a third secret. OKX keys carry a passphrase you choose when you create the key, and it is sent with every request — so it is part of the credential, not a password on top of it.

What happens to the key afterwards

Worth asking of any tool, including this one: where does the key live, and what can reach it? In this tracker an exchange key is encrypted before it is stored, is decrypted only inside the server function that calls that exchange, and is never sent back to the browser — the page that submitted it cannot read it again afterwards, and neither can any later page.

The thing that comes back is balances. That asymmetry is the whole design: credentials travel one way, numbers travel the other.

A short checklist

• Were you asked for a seed phrase or private key? Stop.
• Does the connection require withdrawal permission? Stop.
• Can you revoke it from the exchange without involving the tracker? You should be able to.
• Does the tool show you the key again after saving it? It should not be able to.