Read-only exchange keys, explained: what a key can do, and what we turn away

To show what you hold on an exchange, Burokku needs an API key you make in that exchange's settings. The permissions you tick when you make it decide everything an app can do with it. Burokku reads 10+ exchanges this way, and the first thing it does with any key you paste is find out what that key is allowed to do.

What a read-only key can and can't do

A key with only reading turned on lets Burokku see:

• your balances in each wallet inside the account: spot, funding, earn, futures and the rest;
• your open futures positions;
• your history: deposits, withdrawals, trades and funding payments.

It can't place, change or cancel an order, and it can't withdraw or transfer anything. If someone copied it, they could look at your balances and nothing more.

Exchanges don't name these permissions the same way, so we read each one's own answer rather than guess:

• Binance lists internal and universal transfers apart from withdrawals. We count both as withdrawing.
• Kraken has separate rights for adding or changing a withdrawal address. We count those as withdrawing too.
• Bybit makes a key either read-only or read-write. Only a read-only one connects for reading.
• Coinbase has one right that covers moving funds in and out. A key with it is refused.

How to create a read-only Binance API key walks through one exchange's screens; Burokku shows you each exchange's own steps when you connect it.

How Burokku checks a key before keeping it

When you paste a key, Burokku asks the exchange what the key may do before it stores anything. A key connected for reading must be able to read, and must not be able to trade or withdraw. If it can do either, it's turned away and you're told which right to take off. Nothing is saved.

Why refuse a key that can withdraw, even if you trust us? Because the safest key to hold is one that can't move money at all: a stolen copy can't empty your account. So we never accept one "just in case".

A key that passes is read once there and then, so you see your real balances before you name the account. Where the exchange tells us whose account a key belongs to (Bybit does), a second key for an account you've already added is turned away, so it isn't counted twice.

The check doesn't end at connecting. Burokku asks the exchange about each key's permissions again once a day. If a read-only key has gained the right to trade or withdraw, Burokku deletes it, keeps your last balances on screen, and tells you once, in the app and by email. Connecting a key, and a key we deleted, both go in your account's audit log.

Where your key lives

A key you connect is encrypted on our servers with a key made for your account alone, and bound to that account and that exchange, so a copy moved anywhere else won't open. Nothing outside your account's own space ever sees the plain key.

Once you've pasted it, the key is never sent back to a browser, ours or yours. The app shows only its last four characters. How security works covers the rest of what's kept and where.

When a key stops working

Keys stop working for ordinary reasons: you deleted one, changed its IP allowlist, or the exchange ended it. What Burokku does depends on whether the exchange refused the key or is just hard to reach.

• The exchange refuses the key. Once could be the exchange having a moment, so Burokku waits five minutes and tries again. Refused twice in a row, it stops using the key and tells you once, in the app and by email. It won't keep trying in the background; some exchanges lock out a key that keeps failing. It tries again only when you replace the key or ask it to check again.
• The exchange can't be reached. Burokku waits longer between each try, up to an hour, and keeps showing your last balances. The account only says it can't reach the exchange once that has lasted half an hour.

Some keys end on their own: Bybit and Gate end a key without an IP allowlist after about three months. Burokku reminds you a week before, once, so you can paste a new key before your balances stop updating.

How trading keys differ

If you want to place orders from Burokku, you can connect a key for trading instead, on exchanges that support it, such as Binance and Kraken. The rules for that key are different, and stricter:

• It must be able to trade.
• It must not be able to withdraw or transfer. A trading key that can is refused, as a read-only one would be.
• It must be locked to an IP address. Burokku places orders from one fixed IP address, which it shows you when you connect. The key has to be restricted to it, so a copy is useless anywhere else. Where an exchange doesn't report whether a key is locked, we try the key from a different address: if the exchange refuses it there, it's locked.

Turning trading on also takes two-step verification on your Burokku account, and you confirm it with that second step. Every order is then checked against limits you set before it's sent.

The daily check applies here too. A trading key that gains the right to withdraw, or loses its IP lock, is deleted and you're told once. One that loses its trading right goes back to reading your account. Trading in Burokku explains how orders are priced and checked.

If you're unsure, start with a read-only key. You can see every balance, position and trade beside your wallets, and the key can't move anything. You can add a trading key later, or never.