Read-only API keys: prove your trading record without risking a thing

What a read-only key can and cannot do

• Can: read your trade history, balances, and positions.
• Cannot: place or cancel orders, withdraw, transfer between wallets, change settings, or touch your funds in any way. The exchange enforces this at the permission level — it’s not a promise, it’s a lock.

Worst case if a read-only key leaks: someone sees your history. Bad, but survivable — and you can revoke the key on the exchange in one click, any time.

Creating one (60 seconds per exchange)

• Binance: Account → API Management → Create API → System generated → enable only “Enable Reading.”
• Bybit: Account → API → Create New Key → System-generated → select Read-Only.
• OKX: Profile → API keys → Create → permission Read only (you’ll also set a passphrase).
• Bitget: API Management → Create API → Read-only (passphrase required).
• KuCoin: API Management → Create API → permission General only (passphrase required).

Never enable trade, withdraw, transfer, futures, or margin permissions for any third-party service that only needs to read. A platform that asks for more than read access to “verify” you is a platform to walk away from.

How SMCAlpha uses it

SMCAlpha accepts only read-only keys — a key with any other permission is automatically rejected with instructions to fix it. The key itself is encrypted at rest, the history is imported, and your metrics are computed from the raw fills. You choose what the public sees (percentages by default, never balances unless you opt in), and you can disconnect and revoke at any time. That’s the entire trust model: we can read, and reading is all anyone can do.