Read-only API key: the permissions to tick on Kraken, Coinbase and OKX

A read-only API key is an access key to your account on a platform that can look up your balances, orders and history, but cannot place an order, transfer or withdraw.

Why the key's permissions matter

An app that tracks your portfolio keeps your key to call the platform on your behalf. If that key leaks, it gives away its permissions, and only those. Coinbase warns about its Transfer permission: whoever gets the secret of such a key can send all your crypto out of your account. A read-only key shows only what you see yourself.

The permissions on each platform

Platform	Permissions to give	Permissions to refuse
Kraken	Query Funds, Query Open Orders & Trades, Query Closed Orders & Trades, Query Ledger Entries, Export Data	Deposit, withdrawal, and any permission that creates, modifies or cancels orders
Kraken Futures	General API read-only	General API full access, Withdrawal API full access
Coinbase	View	Trade, Transfer
OKX	Read	Trade, Withdraw

What each permission allows

Kraken: the query permissions read funds, open and closed orders, the ledger and exports; the deposit, withdrawal and order permissions act on the account.
Kraken Futures: a separate key. In read-only mode, it opens only the endpoints that write nothing to the server. Full access makes it a master key, and withdrawals depend on a separate permission, the Withdrawal API.
Coinbase: View looks up the account, Trade places orders, Transfer sends funds.
OKX: Read looks up the account and its history; Trade places and cancels orders, transfers funds and changes settings; Withdraw withdraws.

Restrict the key to an IP address

A key can also be restricted to IP addresses: the platform refuses it when the call comes from anywhere else, even with the right secret.

Kraken offers, for each key, a list of allowed IP addresses and an expiry date.
Coinbase recommends its IP allowlist, without requiring it.
OKX accepts up to 20 IP addresses per key. A key that can trade or withdraw without being bound to an IP address expires after 14 days without use.

Hyperliquid: no key at all

Hyperliquid's info endpoint answers for any address, given in plain text in the request: to track an account, its address is enough. Hyperliquid notes that you must give the account's own address, not that of an API wallet, which returns an empty result.

Check a key afterwards

Review its permissions: the platform's API page shows those of each key.
Delete a key you no longer use: a deleted key is useless, even if its secret has leaked.
Replace a key you have doubts about: create the new one, put it in the app, check that it works, then delete the old one.

How CentraFIN handles your key

Checked before it is kept: CentraFIN asks Coinbase and OKX for a new key's permissions, and refuses it if it can trade, transfer or withdraw. Kraken does not allow this check: the add dialog lists the permissions to tick.
Encrypted: the key and its secret are encrypted (AES-256-GCM) as soon as they arrive and are never shown again.
A single address: calls leave from our relay, 130.110.240.91, the address to allow on your key.

For each platform, step by step: Kraken, Kraken Futures, Coinbase, OKX and Hyperliquid.

Sources

Frequently asked questions

Can a read-only key empty my account?

No. It can neither place an order, nor transfer, nor withdraw. It does show your balances and history to whoever holds it.

Should I use one key per app?

It is better: you can then delete one without touching the others.

Why restrict the key to an IP address?

Because a stolen key becomes useless anywhere else: the platform refuses any call that does not come from an allowed address.

What does CentraFIN see with my key?

What the key can look up: balances, positions, orders, fills and transfers. Nothing more, since it can do nothing else.