Kraken sync with read-only keys

This page is a stub. The full guide is written against the shipped app version and is on its way.

Exchange sync pulls your Kraken history directly, no file export needed. It is built so that trusting it requires reading one page, this one.

Make the key read-only. In Kraken’s security settings, create an API key with query permissions only, the ones that read balances and trade history. Grant nothing that can trade, withdraw, or change the account. The app only ever reads, and a key that can only read is a key that cannot hurt you even if it leaked.

How the request travels. Your browser signs each request itself, using the key’s secret, on your machine. The secret is never transmitted anywhere. The signed request then passes through a small relay, because exchanges do not accept direct requests from web pages, and the relay forwards it to api.kraken.com and returns the answer. The relay holds no accounts, stores nothing, logs nothing, and refuses every destination except the two exchange hosts it exists for, its full story is on the relay page.

What comes back. Your trades and balances, into the same preview-and-reconcile flow as every other import, nothing joins the workspace unseen. Sync again whenever you like, existing rows deduplicate rather than double.

If Kraken answers with an error, the app shows you Kraken’s own message rather than a vague failure, an invalid key reads as exactly that. Check the key was copied whole and its permissions are query-only, then try once more.