Reviewed guide | 2026-10-15
Binance API keys for portfolio apps: read-only access, trusted IPs and safe storage
When a portfolio or tax app asks for a Binance API key, here is how to create one with read-only access, restrict it to trusted IPs, store the secret properly and remove it later.
Multiple exchanges | Kenya | KES | fees, access and account safety
Portfolio and tax apps usually ask for a Binance API key so they can read your balances and trades automatically. Reading is all they need. Yet many people create the key, leave the default permissions untouched or enable more than necessary, and paste the secret into a browser form without thinking about it again. Done carefully, an API key for a portfolio app is low risk. The steps below show what careful looks like on the Binance API Management page.
Create a system-generated key with a clear label
Log in to Binance on the web, open the profile menu and choose API Management. Select Create API, choose system-generated, and give it a label such as tracker read only with the app's name. You will confirm with your two-factor method. The secret key is displayed once; copy it straight into the app and into your password manager.
Leave only Enable Reading ticked
After creation, click Edit restrictions. Enable Reading is the permission a portfolio app needs. Leave spot and margin trading, futures and withdrawals unticked. If an app refuses to work without trading permission, ask why; a tracker that wants to place orders is no longer just a tracker.
Restrict access to trusted IPs
In the same restrictions panel, choose to restrict access to trusted IPs and enter the addresses the app publishes for its servers. Binance limits what an unrestricted key can do and may require an IP restriction for some permissions, which the page explains. If the app cannot provide fixed addresses, read-only access is the most you should grant.
Review and remove
Every few months, open API Management and check each key's label, permissions and restrictions. Delete keys for apps you stopped using. If an app announces a security incident, delete its key immediately, check your recent orders and withdrawals, and only recreate a key once the app has explained what changed.
Where the secret should and should not live
The secret key belongs in two places only: the app that uses it and your password manager. It should never be pasted into email, a notes app, a spreadsheet or a chat with the app's support team, who have no reason to see it. If you think you exposed it, there is no way to rotate the secret on an existing key; delete the key and create a new one with the same restricted settings, then update the app.
Risk boundary: Kenya Crypto Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Label each Binance API key with the app's name and the words read only
- Tick only Enable Reading for portfolio and tax apps and leave every other box empty
- Restrict the key to the app's published IPs and delete it when you stop using the app
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat.