EN Review and revoke your exchange API keys
Contents
At a glance
Audit bot and portfolio-app access, remove unused exchange API keys and test replacements without placing a trade. Includes Kraken Pro and Coinbase Exchange examples.
Decide whether this is maintenance or an incident
An exchange API key lets software access an account without using the normal sign-in screen for every request. A portfolio tracker may read balances; a trading bot may submit orders. This guide helps an account owner list those connections, remove unnecessary permissions and verify a revocation. It covers exchange API access, not wallet seed phrases or blockchain token approvals.
Start with a trusted device, access to the exchange and its authentication method, and the settings for each connected service. Do not begin from a link in an unexpected support message. If you see unfamiliar trades, an exposed secret or an unknown key, treat that as a possible incident: revoke the affected access promptly through the exchange and contact official support. Do not postpone containment to complete this checklist.
For planned maintenance, first identify automated jobs and open orders that depend on the connection. Arrange a pause where possible. Revoking credentials can interrupt monitoring or order management; it is not evidence that existing orders were cancelled. Check those separately in the exchange interface. [1][2]
Make an inventory without copying secrets
Open the exchange from your saved address or official app and find API management. Kraken Pro's documented route is account menu, Settings, then API. Coinbase Exchange documents an API entry in the dashboard sidebar; this example is specifically Exchange, not every Coinbase product. If your interface differs, consult the help page for the product actually in use.
Create a private register with the key label, connected application, account or portfolio, intended task, permissions, expiry and any IP restrictions. Record a creation or last-use time only if the interface provides it. Do not paste the API secret, passphrase or QR code into this register or a support ticket. A descriptive label is enough to match the connection.
Mark each entry as keep, replace, remove or investigate. An unfamiliar label is a reason to investigate, not proof of compromise. Check your own old integrations before attributing activity to an attacker. Keep the exchange's displayed state separate from what the application claims to use. [1][4]
Match permissions to the actual task
Write down what the application must do before changing checkboxes. A balance display does not need to place orders. A historical report may require transaction or ledger access beyond a balance query. For each requested permission, ask which documented function would fail without it; a vague request for full access is not an explanation.
Read-only access still exposes financial information. Trading access can create losses even when withdrawals are disabled. Assess those risks independently. In Coinbase Exchange, View, Trade, Transfer and Manage are separate permissions; its documentation says Transfer bypasses two-factor authentication. A protected web login therefore does not mean each API action will require a phone approval.
Use the smallest permission set supported by the task and the current product documentation. Do not copy permission names between platforms. If a service insists on withdrawals for a simple portfolio display, stop the setup and ask for a specific technical explanation. Do not test the claim by giving it temporary unrestricted access. [1][4]
Check network and storage restrictions
Where supported, an IP allowlist limits the network addresses from which a key can be used. Confirm the connected service's documented outgoing addresses through its official settings or support channel. The relevant address may belong to its server rather than your home computer. Do not add an address supplied only in an unsolicited message.
An allowlist does not restrict what an already authorized service can do within the key's permissions. For a home connection with a changing public address, plan how you will update the restriction; do not remove it reflexively when a connection fails. Kraken also documents expiry settings, which can help bound a temporary connection.
Store necessary credentials in an encrypted credential store or password manager. Avoid screenshots synchronized to a shared photo library. If a secret has already been exposed, moving the same value into safer storage does not revoke the exposed copy. Replace it through the exchange. [1][2]
Revoke or replace the selected key
For an unused connection, select the matching key in the exchange's API management page and use its revoke or delete action. Read the confirmation carefully and verify that the selected label is the one in your register. Removing an app from a phone or disconnecting its dashboard is not a substitute for checking the exchange-side credential.
For a planned replacement, follow the product's documented order of operations. Coinbase Exchange instructs users to revoke the existing key first, create a minimally permitted replacement, update applications and test it. Expect an interruption under that procedure. Do not promise a seamless change or preserve a compromised key merely to avoid downtime.
If the service is still needed, save the replacement securely and update only the intended integration. Check the portfolio selection, permissions and network restriction again rather than assuming they were inherited. Never send the new secret to someone offering to verify the change for you. [2][3]
Verify the result in both systems
Refresh the exchange's API list and confirm the old key is absent or explicitly revoked. Then check the connected service's next attempted synchronization and its timestamp. A balance still visible on screen may be cached; it does not establish continuing access. Conversely, a connection error alone does not prove revocation, because network failures can cause the same symptom.
For a replacement, use a harmless read operation already supported by the application, such as refreshing balances. Compare the returned account and time with the exchange. There is no need to place a trade or withdraw funds just to check a connection. Review the saved permissions in the exchange instead of experimenting with an unwanted financial action.
Inspect open orders and recent activity separately. Document what you verified and what remains uncertain. This workflow checks access settings; it cannot prove that previously shared data was erased or that an earlier unauthorized transaction has been reversed. [3]
Worked example: retire an old portfolio connection
Suppose an old portfolio app no longer serves a purpose. Your register says it should only read account data, but the exchange also shows trading permission. This is a hypothetical example, not a reported incident.
Record the label and permissions without the secret, check whether any other job shares that key, and remove it at the exchange. Refresh the key list. In the old app, a later refresh should no longer obtain private account data through that credential; record the result without treating an old displayed balance as proof of access. Remove the saved connection from the app as a separate cleanup step.
If you still need reporting, create a separate, appropriately restricted connection after checking the new service's requirements. Keep the old key revoked. Your completion record should name the removed connection, the replacement if any, the verification time and unresolved questions. Do not attach credentials to that record. [2][3]
If verification fails
If the old key remains active after confirmation, stop making replacement keys and contact the exchange through its independently opened support channel. If a replacement cannot connect, check product compatibility, selected account, permissions, allowed address and whether the application actually saved the new credential. Do not solve an unexplained error by enabling every permission.
If unfamiliar activity continues, use the exchange's account-compromise process from a trusted device. Preserve timestamps and transaction identifiers without disclosing secrets. Review other keys and sessions; an API-key change alone is not a complete account investigation.
Set a review reminder when you stop using a service, change its host or learn of a relevant incident. The goal is an accurate inventory and confirmed revocation of unnecessary access, with any remaining dependency clearly recorded. [2][3]
Frequently asked questions
Does read-only mean there is no risk?
No. It restricts actions but can disclose balances and account history. Grant only the information access the task needs. [2]
Will deleting a bot revoke its key?
Do not assume so. Check API management at the exchange and revoke the credential there; remove the app's saved connection separately. [3]
Must I trade to test the new key?
No. Start with an authorized balance refresh and inspect the saved permissions. Do not place a financial order solely to test access. [3]
Evidence & sources
Source record: · Checked:
Record limits · Official documentation checked on 5 November 2026. Kraken Pro's setup page was updated on 29 October 2026. This is a preventive guide, not a report of a new breach. Account controls vary by product.
- Source reported
Kraken Pro documents separate API permissions and optional network and expiry restrictions.
Supporting excerpt: So erstellen Sie einen API-Schlüssel auf Kraken Pro
Die IP-Adressbeschränkung ist eine Sicherheitsfunktion
So erstellen Sie einen API-Schlüssel auf Kraken Pro ↗ - Source reported
Kraken recommends minimizing API permissions and deleting keys that are no longer needed.
Supporting excerpt: Sicherheit für API-Schlüssel
Lösche regelmäßig API-Schlüssel, die nicht mehr relevant sind.
Sicherheit für API-Schlüssel ↗ - Source reported
Coinbase Exchange documents revoking the existing key before creating and testing its replacement.
Supporting excerpt: How to rotate your API key
First, revoke or delete the current API key.
How to rotate your API key ↗ - Source reported
Coinbase Exchange separates View, Trade, Transfer and Manage permissions and warns that Transfer bypasses two-factor authentication.
Supporting excerpt: How to create an API key
Key can transfer value for accounts, including deposits and withdrawals (and bypasses 2FA)
How to create an API key ↗
Related reading
Passkey, TOTP or SMS: secure your exchange account
Compare passkeys, authenticator codes and SMS for exchange accounts. Set up a stronger sign-in method and test access before losing your phone.
Read article : Passkey, TOTP or SMS: secure your exchange account
Fake exchange support: how to verify a request
Verify an exchange support request and protect your account if you shared a code, allowed remote access or sent cryptocurrency.
Read article : Fake exchange support: how to verify a request
Before a crypto deposit: check network, address and memo
Check an exchange deposit route before sending: match the asset and network, copy the required memo, review limits and confirm that the funds were credited.
Read article : Before a crypto deposit: check network, address and memo