An API key is still a security boundary

A read-only key cannot withdraw funds when it is configured correctly, but it can expose balances and account activity. Create a dedicated key for the tracker, never reuse a trading bot credential, and treat the secret like a password.

Enable the minimum permissions

The service needs balance access and, for cash-flow-adjusted P&L, permission to read deposit, withdrawal or ledger history. Trading, order placement, transfers and withdrawals must remain disabled. If an exchange bundles read and write access, do not use that credential.

Provider labels are not identical

Binance uses account and USER_DATA terminology, Bybit exposes Assets for Unified accounts, Kraken separates Query Funds from Query Ledger Entries, and OKX requires Read plus a passphrase. Follow the provider-specific guidance shown in the connection dialog.

What the tracker stores

Exchange credentials are encrypted independently with AES-256-GCM. Keycloak tokens stay only in browser memory; developer API tokens are stored only as hashes. The service decrypts a credential only at the exchange integration boundary to sign the requested read operation.

Deletion and revocation are different

Removing a connection deletes the service copy and its holdings. It does not revoke the original credential at the exchange. Revoke unused keys in the exchange security settings, review them periodically, and replace any credential whose permissions changed unexpectedly.