Why Your Portfolio Tracker Should Not Have Your API Keys

Every auto-sync portfolio tracker makes the same pitch: connect your exchange, connect your broker, and never type a number again. It is a real convenience. It also means a third-party app now holds standing credentials to accounts that contain your money — and most people click "connect" without reading what that access includes.

This is not fearmongering; it is a trade-off worth understanding before you make it.

What You Are Actually Handing Over

An exchange API key is a password with a scope. A "read-only" key can see your full balance, position sizes, and complete trade history. Keys with trading permissions can place orders. Keys with withdrawal permissions — which you should never create for a tracker, ever — can move funds.

Even in the best case, read-only, you have given a third party a permanent, real-time map of your wealth, tied to your email address, sitting in their database.

The Four Failure Modes

1. The tracker gets breached. Portfolio trackers are honeypots: thousands of users' API keys in one database. Major crypto trackers have suffered breaches — CoinStats had a well-publicized security incident in 2024 in which wallets created in-app were affected. Even when exchange keys stay safe, leaked holdings data alone makes users targets.

2. Phishing gets personal. If attackers learn you hold $80,000 in crypto and which exchanges you use, you stop getting generic spam and start getting tailored attacks — fake "security alerts" from your exchange, SIM-swap attempts, even physical risk for large holders.

3. Silent sync failures. API connections break: exchanges rotate endpoints, keys expire, rate limits hit. The dangerous part is that trackers often fail silently, showing stale balances. A tracker that is wrong is worse than no tracker — you make decisions on numbers that no longer exist.

4. Coverage is never complete anyway. Your hardware wallet has no API. Your DeFi positions sync partially or not at all. That broker your country uses is not supported. So you end up with auto-sync for half the portfolio and a spreadsheet for the rest — the worst of both worlds.

The Manual-First Alternative

Here is the thing the auto-sync marketing skips: for most retail investors, positions do not change that often. Logging a trade takes about thirty seconds. In exchange for those thirty seconds you get complete coverage of every account and wallet you own, zero standing credentials held by anyone, and numbers you actually verified yourself.

The workflow that works:

• Log each position once: asset, amount, entry price, where it is held
• When you trade, log it the same day — it is a 30-second habit
• Use CSV import for bulk history: every exchange and broker exports one, and no login is needed
• Let the tracker fetch live prices — a ticker symbol is public data and requires no access to your accounts

That last point is the key distinction: a well-designed tracker needs to know what you hold, never where your money lives. Price lookups by symbol expose nothing about you.

Questions to Ask Any Tracker

Before connecting anything, check: Does it require API keys or broker logins at all? What does its privacy policy say about selling or sharing data? Where is data stored, and is your data isolated from other users? Can you export everything and delete your account?

For the record, Trackfolio's answers: no API keys or broker logins ever, no data selling, an EU-hosted database with row-level security, and full export plus one-click deletion. It is in the privacy policy in plain English.

Convenience Is a Price, Not a Feature

Auto-sync trackers are not evil — for very active traders on supported exchanges, the trade-off can be worth it. But it is a trade-off, and "we take security seriously" is not a security model. If a tracker can be complete, accurate, and require zero access to your accounts, the thirty seconds per trade starts looking like the cheapest insurance in your portfolio.

We wrote a full system for this in How to Track Your Crypto Portfolio Across Wallets and Exchanges.

Ready to start your trade journal?

Trackfolio is free — log trades, track P&L, and review your psychology in one place.