Read-only vs trade-enabled API keys: what a monitor should ask for
Exchange API keys carry separate permissions — read, trade, withdraw. A monitoring tool only needs read. Here's the difference, why you should refuse anything more, and how Chartping enforces it.
An exchange API key isn't all-or-nothing — it carries separate permissions: read, trade and withdraw. A monitoring tool only needs the first. Knowing the difference is the single most useful thing you can do before connecting any account-watching tool. This is a plain-language explainer, not advice.
Three things a key can be allowed to do
On most exchanges an API key is granted independent scopes:
- Read — see balances, positions, margin and history. Nothing changes.
- Trade — place, modify and cancel orders on your behalf.
- Withdraw — move funds off the account.
They're separate on purpose. A key can be read-only, or read-and-trade, or carry withdrawal rights — and you choose which when you create it.
A monitor only needs “read”
To watch equity, margin and positions and warn you, a tool needs read and nothing else. If an account-monitoring product asks for trade or withdrawal permission, that's a red flag worth pausing on: it's asking for power it doesn't need to do the job. Chartping is read-only by design — it exposes no order or withdrawal path at all.
How Chartping enforces read-only
Where an exchange lets Chartping prove a key's scope — Binance, Bybit and Deribit — a key that can trade or withdraw is rejected at connect and never stored. Where scope can't be read (OKX, Kraken, KuCoin and others) the key is accepted but hard-flagged, and Chartping still exposes no order or withdrawal path, so it can't act on it either way. Broker tokens (OANDA, Alpaca, Tradier) are used strictly read-only, and Hyperliquid needs no key at all — it's watched from your public wallet address. Keys are encrypted at rest (AES-GCM). The full per-exchange breakdown is on the read-only API keys page.
What to refuse when you create a key
Leave trading and withdrawals disabled when you generate the key, and if the exchange offers IP allow-listing, use it. Never hand a monitoring tool a withdrawal-enabled key — no monitor needs one, and a key that can't move funds can't be misused if it ever leaks. That's least privilege, and it's the whole point of the read-only model on the security page.
See it in practice on a Binance account, or across every exchange and broker Chartping connects. It never trades.
Frequently asked
What API key permissions does Chartping need?
Read only. Chartping reads your account state to monitor it and never needs trade or withdrawal permission. When you create the key, leave trading and withdrawals disabled.
What if I accidentally give a trade-enabled key?
On Binance, Bybit and Deribit, Chartping proves the key's scope at connect and rejects any key that can trade or withdraw. On exchanges where scope can't be read, the key is accepted but hard-flagged — and Chartping still exposes no order or withdrawal path, so it can't act on it.
Why does a read-only key matter if I trust the tool?
Least privilege: a key that can't trade or withdraw can't be misused — by the tool, or by anyone who ever got hold of it. It's the same reason Chartping encrypts keys at rest and rejects withdrawal-capable keys where it can.