Crypto Exchange API Keys: Which Rights to Switch Off

An API key is not a password and not access to your account in the usual sense. It is a power of attorney with individually tickable rights that you hand to someone else's software: to the tax tool that collects your trades for the German “Anlage SO” annex, to the portfolio tracker or to the trading bot. What matters is which boxes you tick when you create it. We looked at which rights the exchanges that German investors actually use even offer, and where the dangerous defaults sit.

What an API key on a crypto exchange unlocks

An API key consists of two character strings, a public key and a secret counterpart, with which a program identifies itself to the exchange without knowing your password. That is exactly the point: because the key is an identity of its own, it also carries a set of rights of its own. A program that reads your trading history for the tax return needs read rights and nothing else.

In practice the opposite often happens. Anyone who wants to be done quickly ticks everything on offer, because it is unclear what the tool in question might want to query later. The key then sits in someone else's account for years carrying rights that were never used. For Bitcoin and every other holding on the same exchange, that power of attorney then applies just the same.