API keys: what read only means and why it matters
Connecting a tool to your exchange account is a real decision. What permissions actually allow, and the ones you should never grant.
Permissions are not all the same
An exchange API key is not one thing. It is a set of permissions, and the difference between them is the difference between a tool that can read your history and one that can empty your account.
The dangerous part is that they look identical when you are creating them and the risky option is often the default.
What to grant, and what never to
- Read: lets a tool see your orders and balances. This is all any analytics product needs.
- Trade: lets it place and cancel orders on your behalf. No ledger or reporting tool needs this.
- Withdraw: lets it move funds out. There is essentially no legitimate reason to grant this to a third party tool.
Sensible habits
- Bind the key to an IP address where the platform allows it.
- Create a separate key per tool, so one can be revoked without breaking the others.
- Revoke keys for anything you have stopped using, rather than leaving them live indefinitely.
- Treat the secret like a password, because it is one.
What P2Proof asks for
Read only, and nothing else. P2Proof cannot place a trade and cannot withdraw, because it never requests those permissions and would not function differently if you granted them.
That is a deliberate limit rather than a feature that is coming later. A tool whose entire job is to tell you the truth about your numbers has no business being able to move your money.