Is it safe to connect an exchange API key to Crypto Tax?
The short answer
Yes, when the key is created read-only: such a key can read the account’s history but cannot withdraw or move funds, Crypto Tax refuses a key the exchange reports as able to withdraw, and the key is stored encrypted.
In brief
- Permission needed
- Read only
- A key that can withdraw
- Refused, where the exchange reports the key’s permissions
- A key that can trade
- Accepted with a warning
- Key storage
- Encrypted, and never shown again
- Sync
- Once a day
- Removing the key
- Deletes it and the transactions it imported
How do you create a read-only key?
In the exchange’s API settings, create a new key and tick only the read permission, with no trading, withdrawal or transfer permission. Such a key can read the account’s history and balances, and cannot take any action on the account.
It is best to create a separate key for Crypto Tax alone, so it can be revoked on the exchange without affecting anything else.
What does Crypto Tax check on the key?
On connecting, Crypto Tax reads the permissions the exchange reports for the key. A key that can withdraw funds is refused, and a key that can trade is accepted with a warning, because importing the history needs read permission only.
Not every exchange reports all of a key’s permissions, so on every exchange, take care to create the key read-only.
The permissions are checked again after every sync. A key that has since gained withdrawal permission stops syncing until it is replaced with a new key.
How is the key stored?
The key and its secret are stored encrypted, and are never shown again, written to logs or included in the data export. The interface shows only the last four characters of the key’s id, so you can tell which key it is.
Under Amendment 13 of the Privacy Protection Law, in force since August 2025, information on a person’s financial activity is information of special sensitivity. Regulation 14(b) of the Privacy Protection (Data Security) Regulations requires data sent from a database over a public network or the internet to use accepted encryption methods, and all communication with Crypto Tax is encrypted.
What happens after connecting, and how do you remove a key?
The history the exchange returns is imported as soon as the key is connected, and the key then syncs once a day. After every sync, on exchanges that report balances, Crypto Tax compares the balances with the imported history and shows any gap.
Removing the key in Crypto Tax deletes it, the transactions it imported and the exchange responses kept for it. Where the key’s transactions are used by a report already generated, you delete the report first, and the tax year stays unlocked.
Removing the key in Crypto Tax does not revoke it on the exchange, so revoke it in the exchange’s API settings as well.
Sources
Last updated: 2026-10-29
This page is general information only and is not tax advice. For your own circumstances, consult a tax advisor or accountant.