How to create a safe API key for a trading journal
A trading journal only needs to read your trade history. Here is which permissions that takes on each exchange, what to never switch on, and how to avoid a key that suddenly stops working.
The main rule: never allow withdrawals
A journal reads history — it never needs to move money. When you create the key, leave withdrawals and transfers off. With that, nobody can take funds out of your account through this key, even if it leaks.
Also never share your exchange password, 2FA codes, seed phrase or wallet private key. A legitimate journal never asks for them — if someone does, it is a scam.
Which permissions each exchange needs
- Binance — Enable Reading + Enable Futures. Without the futures permission Binance does not return futures history; note that this permission technically allows trading.
- Bybit — Read-Only, with Positions (Unified Trading account).
- OKX — Read, plus the passphrase you set for this key.
- Bitget — Read-Only with Position, plus the key’s passphrase.
- MEXC — Read with Futures (Contract).
- Gate.io — Read-Only with Futures.
- BingX — Read with Perpetual Futures; like on Binance, this permission technically allows trading.
- Hyperliquid — no key at all: your public wallet address is enough.
The passphrase on OKX and Bitget is the one you create together with the API key — not your account password.
See these numbers for your own trades
Connect an exchange and your trades load automatically — PnL, fees and funding per trade. The demo works without signing up.
IP restriction and expiry
Exchanges let you bind a key to fixed IP addresses. A service that loads history from its own servers needs a key without an IP restriction, otherwise the exchange rejects the requests (Bybit, for example, answers with an authorization error).
Keep in mind that some exchanges — MEXC and Bybit among them — automatically expire keys without an IP binding after about 90 days. When that happens the journal simply stops getting new trades; create a new key and paste it in place of the old one.
Where the secret goes
The exchange shows the secret only once. Paste it straight into the service and do not keep it in chats or notes. CheckMyProfit stores keys encrypted (AES-256-GCM) and uses them only to read history; you can delete a key at any time — in the service or on the exchange.