Any tool that automates trades on your behalf needs some way to actually place those trades. On most exchanges, that means an API key: a set of credentials the exchange issues that let a third-party app act on your account without your password.

The question that matters is what that key is allowed to do.

Two very different kinds of permission

Exchange API keys aren't all-or-nothing. Most exchanges, including Kraken, let you scope a key to specific permissions when you create it. The two that matter most here:

  • Trade permissions: place and cancel orders, read balances and order history.
  • Withdrawal permissions: move funds out of the exchange entirely.

A key with trade permissions can buy and sell inside your account. A key with withdrawal permissions can send your funds somewhere else, full stop. Those are not the same risk.

No automated rebalancing or trading tool needs withdrawal access to do its job. It needs to place trades. If a tool asks for withdrawal permissions - or doesn't make clear that it doesn't need them - that's worth stopping and asking why.

Why this distinction actually matters

If a trade-only key is ever compromised, leaked, or misused, the worst case is that someone places bad trades inside your account. That's a real problem, but it's a contained one - your funds are still on the exchange, under your control, and you can revoke the key and stop the bleeding.

If a withdrawal-enabled key is compromised, the worst case is that your funds are gone. There's no revoking your way out of a completed withdrawal.

This isn't a hypothetical distinction. In December 2022, a major crypto trading bot platform had roughly 100,000 API keys exposed in a breach. The keys involved were largely trade-only, which meant attackers couldn't withdraw funds directly - but they could and did place manipulative trades to profit at affected users' expense. That's the honest version of the lesson: trade-only permissions remove the worst-case outcome (your funds disappearing), but they don't make a key leak harmless. Encryption, access controls, and minimizing what any key can do all still matter.

What to actually check before connecting a key to any tool

A few things worth looking at, for Rebalance or anything else you're considering connecting to your exchange account:

  • Does it ask for withdrawal permissions at all? If yes, and it doesn't have a specific, well-justified reason to, that's a red flag.
  • Can you scope the key down yourself? Kraken (and most major exchanges) let you choose exactly which permissions a key gets when you create it. Grant only what's needed, not everything available.
  • How are your keys stored? They should be encrypted and stored securely, not sitting in plaintext or exposed anywhere in an application's code.
  • Can you revoke access instantly? You should be able to cut off a key from your exchange's side at any time, independent of whatever the third-party tool does on its end.
  • Can you see what it's about to do before it does it? A tool that shows you a preview before executing anything gives you a chance to catch something wrong before it happens, not just review the damage after.

How Rebalance handles this

Rebalance connects to your exchange with trade-only API permissions. No withdrawal scope is ever requested - not "we promise not to use it," but that the permission itself isn't part of what we ask you to grant. Keys are encrypted and stored securely, never exposed in application code. You can revoke access from your exchange's side at any time, and every trade Rebalance would make - whether a routine rebalance or a tax-loss harvest - can be previewed before it executes.

None of this makes Rebalance, or any tool, invulnerable. It means that if something ever does go wrong, the blast radius is contained to trades inside your account, not your funds leaving it. That's the whole point of asking for less access in the first place.

Curious what Rebalance actually does with that access? See the full security details, or start a 3-day free trial to see it firsthand. A payment method is required to start, but you won't be charged until the trial ends, and you can cancel anytime.