Which Rights to Switch Off

An API key is not a password and not access to your account in the usual sense. It is a power of attorney with individually tickable rights that you hand to someone else’s software: to the tax tool that collects your trades for the German “Anlage SO” annex, to the portfolio tracker or to the trading bot. What matters is which boxes you tick when you create it. We looked at which rights the exchanges that German investors actually use even offer, and where the dangerous defaults sit.

What an API key on a crypto exchange unlocks

An API key consists of two character strings, a public key and a secret counterpart, with which a program identifies itself to the exchange without knowing your password. That is exactly the point: because the key is an identity of its own, it also carries a set of rights of its own. A program that reads your trading history for the tax return needs read rights and nothing else.

In practice the opposite often happens. Anyone who wants to be done quickly ticks everything on offer, because it is unclear what the tool in question might want to query later. The key then sits in someone else’s account for years carrying rights that were never used. For Bitcoin and every other holding on the same exchange, that power of attorney then applies just the same.

The trigger: a phishing wave in September targeted precisely these keys

On September 10, 2026, attackers gained access to customer accounts of the email service provider Brevo and used them to send messages that came out of the genuine sending routes of well-known crypto providers. Among those affected were users of hardware wallet manufacturers and of tax and tracking services. What sets this wave apart from ordinary phishing is the sender address: it was real, and the usual tells did not apply. We worked through the incident in our report on the Brevo breach and the user data affected.

For anyone who entered credentials on such a page, the providers’ recommendation is unanimous: change the password, check two-factor authentication, and, if keys for a crypto exchange were stored there, revoke and regenerate them directly at the exchange. That last point regularly gets lost in the excitement, because many investors no longer know how many keys they have handed out over the years.

What we examined, and how

This analysis was compiled by cryptoticker.io itself on September 16, 2026. Method: we retrieved the publicly reachable documentation and help pages of the providers and evaluated exclusively what is stated there in plain words, without opening an account and without generating a key. Twelve pages from eight providers and tools were examined.

Three limitations belong with this, and they are not a formality. The help pages of Bitvavo and Bitpanda answered our automated retrieval with code 403 and thus block machines, not readers; we confirmed their content with code 202 and delivered no text that could be evaluated. And we did not measure whether the exchanges enforce the documented rights in live operation exactly as they describe them

Kraken, Bitvavo and Binance: which rights you grant individually

The finding first: all three exchanges separate reading, trading and withdrawing into separate rights, and all three offer a restriction to fixed IP addresses. The difference lies in the detail, and the detail decides.

Kraken: the finest breakdown of the three

Kraken splits the rights further than its competitors. Kraken’s help page on creating an API key lists, among others, “Query Funds”, “Deposit Funds” and “Withdraw Funds” for the money side, plus “Query Open Orders & Trades”, “Query Closed Orders & Trades”, “Modify Orders” and “Cancel/Close Orders” for trading, along with “Query Ledger Entries” and “Export Data”. Withdrawing is a tick of its own: according to the documentation, “Withdraw Funds” is needed only for the withdrawal endpoints. One setting is notable because it is missing elsewhere: Kraken allows an expiry date for the key, explicitly including short periods such as a week.

For a tax tool, the query rights together with “Query Ledger Entries” and “Export Data” are therefore enough. Everything else may stay switched off.

Bitvavo: three rights, and one sentence you should know

Bitvavo knows three rights: viewing account data and balances, trading, and withdrawing to an external address or a verified bank account. When creating the key you additionally set the IP addresses from which it is valid, and creation requires active two-factor authentication. The most important sentence on Bitvavo’s help page on API keys concerns withdrawal, however: withdrawals requested through an API key bypass the two-factor prompt.

Anyone who believes the second factor catches everything when it matters is mistaken for this one route. Two-factor authentication protects your login. A key with withdrawal rights works around it.

Binance: trading rights with built-in expiry

Binance separates reading, spot and margin trading and withdrawals into switches of their own. The peculiarity is a rule that many users notice only when their bot suddenly stops: without a stored IP address, the trading right expires by itself after 90 days and is deselected automatically. With an IP restriction it stays. The withdrawal right, in turn, can only be activated at all if an IP restriction is set.

This coupling is the strictest among the providers examined, and it is a model to follow: the most dangerous right is available only together with the setting that defuses it.

Why a key without withdrawal rights can still cost you money

The obvious assumption runs: without withdrawal rights, a stolen key can do no damage. That assumption is too optimistic, and the specialist literature has contradicted it for years. Security researchers have described how attackers turn keys without withdrawal rights into money anyway: they trade the foreign balance against orders of their own in thinly traded markets. The balance never leaves the exchange, it merely changes owner at absurd prices. Two patterns keep coming up here, buying out a sell wall and deliberately bidding up an illiquid token.

Alongside that stands a more sober assessment from developer practice, which does not talk the damage down but does put it in proportion: without withdrawal rights, all a thief can do is make strange trades, and those are bad, limited in size and stoppable by revoking the key. Both views are compatible. A trading right does not prevent the loss, it limits it. A withdrawal right, by contrast, knows no limit other than your balance.

In practice that means: if you connect a trading bot, the trading right is unavoidable, and you should keep the holding on the connected account small. If you connect a tax tool, it is simply superfluous.

The IP whitelist devalues a stolen key

The IP whitelist is the most effective setting available in this context, and at the same time the one least often set. It determines from which internet addresses the key is accepted at all. An attacker who captures the character string can do nothing with it as long as he is not also sending from precisely that address. Bitvavo puts this plainly in its help pages: anyone who stores no IP list gives everyone who holds the keys the ability to trade in the account.

The catch lies in home use. A tax tool retrieves your data from its provider’s servers, not from your laptop. The matching address is therefore the service’s, and you have to ask them for it; reputable providers publish it. For a self-operated bot on a rented server the matter is simple, because its address is fixed. For a bot on the home computer with a changing address it is impractical, and that is exactly where the field then stays empty.

If you cannot set the IP restriction, expiry remains as a substitute. Kraken offers an expiry date for this, Binance enforces one on the trading right after 90 days. A key that is going to die in three months anyway is a considerably smaller problem than one that has been sitting in a forgotten account since 2021.

Bitpanda, Trade Republic and Bison: when there is no key to hand over at all

At the providers through which many German investors actually buy, the situation looks different, and in their favour. Bitpanda issues API keys covering trading, transactions and balances, and this access is read-only throughout. A key that knows no trading or withdrawal right at all cannot lose one either. Anyone connecting a tax tool does not have the decision to make there.

Trade Republic goes one step further and offers no official interface for retail customers. Since May 2026 there has instead been a CSV export of the transaction history that you download and upload into your tax tool. That is less convenient, because you do it by hand at every update, and safer, because no lasting power of attorney comes into being. For Bison the same route

There is a misunderstanding here that holds on stubbornly: the makeshift solutions from the community, meaning browser extensions and reverse-engineered interfaces, are not official access routes. They reach into the logged-in session. What you give them is not a narrowly defined right, but your entire login.

Tax tools and the German duty to cooperate

The reason so many API keys are in circulation in Germany at all is written in tax law. Anyone holding crypto assets in private wealth has to be able to document acquisition dates, acquisition costs and disposals, because the one-year period and the size of the gain depend on them. No provider produces these records by itself in the form the tax office wants to see. That is why many investors reach for a tool that collects the history and produces a statement, and that is why they hand out a key.

Which tool comes into question for this and what it costs, we broke down in our price comparison of crypto tax software; the overview of providers with their import routes sits in the hub for crypto tax software and portfolio trackers. For the security question only one thing matters: a tool that demands a trading or withdrawal right in order to calculate tax demands too much. There is no tax reason to be able to trade from inside a tax program.

A second point concerns the volume of data. A key with read rights gives the provider lasting insight into your complete trading history and your holdings. That is necessary for the calculation, but it makes the provider a rewarding target. That is precisely why the September mails hit customers of tax and tracking services and not only wallet owners.

Revoking and regenerating API keys: the right order

If you suspect that a key has leaked, a fixed order applies, and the first step belongs to the exchange. First you revoke the key in the exchange’s account settings. From that moment the character string is worthless, regardless of who holds it. Only then do you generate a new one and enter it in the tool. Anyone who reverses the order and tidies up at the tool first leaves the old key running.

After that comes a look into the account history, and at two things in particular: at trades you did not trigger yourself, and at logins or accesses from unknown addresses. Conspicuous trades in thinly traded tokens are the typical pattern of the attack described above. If you find something, it belongs with the exchange’s support immediately, in writing and with timestamps.

The third step is the inconvenient one: a full inventory of every key you have ever handed out. Every exchange lists the active keys in its settings, usually with a creation date and last use. Anything you cannot assign with certainty, you delete. A key that is still needed will announce itself within a few days through a tool that no longer pulls data. That is a small price for getting rid of a forgotten power of attorney.

AdvertisementCrypto trading bots compared

What this analysis does not show

Honesty about the limits belongs to any survey of one’s own. We read documentation, we did not measure behaviour. Whether an exchange really refuses a deselected right when it matters could only be checked with a real account and real orders, and we did not do that. Nor does this analysis say anything about how carefully the individual tax and tracking providers store the keys entrusted to them. That is the genuinely open question, and it cannot be answered from the outside.

We also did not examine the offerings that never made it into the selection because they play no notable role in Germany. The rights models there may differ. Rely therefore on the settings page of your own provider and not on an overview, this one included.

Checking your API keys: what you take away from this

1. Open your exchange’s API overview today and count how many keys are listed there. Anything you cannot assign to a tool in use gets deleted. Which exchange offers this overview and how clearly is set out in our hub on the best crypto exchanges.
2. Take the trading and the withdrawal right away from every key that is only meant to deliver data. For a tax tool, reading is enough. Which tools get by on pure read rights is shown by the hub for crypto tax software and portfolio trackers.
3. Set an IP restriction, and if that is not possible, an expiry date. With a self-operated bot the server address is fixed and the setting is done in two minutes; you will find the providers for that in the hub on crypto trading bots.

Checking the rights at your exchange takes less time than reading this text. The difference only shows on the day a mail arrives from a genuine sender address and asks you for something it must not be given.

(As of September 16, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primaryI

Source: cryptoticker.io