In short. A read-only API key lets a service see your trades, positions and balances but not trade or withdraw. You create it in the «API» section of the exchange website: choose a system-generated key, tick read access only and leave trading, transfers and withdrawals off. Below are the steps for Bybit, Binance, OKX, BingX and HTX according to the exchanges' official help pages as of 11 October 2026; interfaces change, so check their help when in doubt.
General rules
- Never enable withdrawals on a key you give to a third-party service. Trading is not needed for analytics either.
- The secret key is shown once — save it immediately and do not send it over messengers.
- One key per service. Stopped using it — delete the key on the exchange.
- System-generated key (HMAC). Exchanges also offer self-generated keys (RSA, Ed25519); Davinchu needs a system-generated one.
Summary
| Exchange | Read permission | Read-only key without an IP restriction | Notes |
|---|---|---|---|
| Bybit | Read-Only | valid for 90 days, can be extended | created on the website only; new users — 48 hours after sign-up |
| Binance | Enable Reading (on by default) | allowed, with read permission only | requires 2FA, a deposit and identity verification |
| OKX | Read | does not expire | you set the Passphrase, it cannot be recovered |
| BingX | read | does not expire | up to 20 keys per account |
| HTX | Read | per the docs — 90 days | confirmed with SMS, email and Google Authenticator codes |
Bybit
- On the website: profile icon → «API» → «Create New Key». Keys cannot be created in the app.
- Type — System-generated API Keys, purpose — API Transaction.
- Choose Read-Only. For futures, Davinchu needs read access to Contracts (Orders & Positions); do not tick withdrawals.
- Confirm with a Google Authenticator code and save the key and secret.
A key without an IP restriction is valid for 90 days. To extend it without changing the key, in the «IP Address Added» column choose edit → «No IP restriction» → confirm with the email and 2FA codes. Davinchu works with the Unified Trading Account; the classic Bybit account, according to the exchange's docs, is no longer available.
Binance
- You need 2FA enabled, a deposit of any amount to the Spot wallet and identity verification.
- On the website: profile icon → Account → API Management → Create API. In the app: More → Other → API Management.
- Type — System generated (HMAC); enter a name and confirm with 2FA or a passkey.
- Keep only Enable Reading on — it is on by default. Enable Spot & Margin Trading, Enable Margin Loan, Repay & Transfer, Permits Universal Transfer, Enable Withdrawals and Enable Futures must stay off.
IP restriction is in Edit restrictions → «Restrict access to trusted IPs only». It is optional for a read-only key: a system-generated key without an IP restriction can only have read permission.
OKX
- On the website: profile → «API» (or «API and connections») → Create API key. In the app: menu → API → Create API key.
- Tick only Read; leave Trade, Withdraw, Transfer, Loan and Earn off.
- Set a Passphrase. It cannot be viewed or recovered later: if you lose it, the key has to be recreated.
- Confirm with 2FA codes and save the API Key, Secret Key and Passphrase — all three are needed to connect.
An IP restriction is optional; read-only keys do not expire. In some regions creating a key requires at least 100 USD in assets.
BingX and HTX
BingX: keys are created on the API page of your account («Create API»); a read-only key does not expire, keys with trading permissions and no IP restriction are deleted after 14 days without use. HTX: account icon → «API Management», tick only Read, confirm with SMS, email and Google Authenticator codes; the Access Key and Secret Key are shown once. Per the HTX docs, a key without an IP restriction is valid for 90 days.
Connecting the key in Davinchu
- In the dashboard, in «Accounts», add an exchange account and choose the market: spot or futures on Bybit and HTX, spot on Binance, OKX and BingX.
- Paste the API Key and Secret, plus the Passphrase for OKX.
- The dashboard checks the permissions: a key with withdrawal rights is rejected, a key with trading rights is accepted with a warning.
The account settings show the key's permissions — read, trade, withdraw, transfer — and the «Check API» button re-reads them from the exchange. A new key for the same exchange account goes in with «Update key»: the account history and settings stay. If the key is bound to an IP, the exchange will reject requests from our server — create a key without an IP restriction.
With a Bybit key, futures and spot trades flow into the journal with up to two years of history — no need to export files as described in «Bybit trade history: how to export and analyze it». With an HTX key, USDT-M futures trades arrive from the moment of connection, and spot balances from all five exchanges are collected in the «Investments» portfolio — see «Crypto portfolio tracking». More on the «Account monitoring» page and in «Crypto trading journal».