Why HODLTrack will never ask for your exchange API keys — and what we built instead

When we were designing HODLTrack's onboarding, we had an obvious choice in front of us: ask for exchange API keys like every other crypto tracker does.

It would have been easier to build. Users love the "connect once, never type a trade again" experience. And every competitor does it.

We chose not to. Here's why.

Exchange API keys — even read-only ones — are a persistent security surface. Once you paste your Coinbase or Binance key into a tracker, that tracker has ongoing access to your balance, your trade history, and depending on the exchange, parts of your KYC data. Most users never revoke those keys. If the tracker gets breached, acquired, or just pivots their privacy policy, your data is already there.

We're building a portfolio tracker for people who care about privacy. Asking for API keys on day one sends exactly the wrong signal.

So we built CSV import instead.

You export a balance snapshot from Binance, Coinbase, Kraken, or Crypto.com — a one-time file that you control. We process it and it's gone. No persistent connection, no background polling, no ongoing access to your exchange account.

The tradeoff is that updates aren't automatic — users add new trades manually after the initial import. For most people, that's 30 seconds per trade. We think that's a worthwhile tradeoff for not having a live wire into your exchange account.

We just published a step-by-step guide covering the export flow for all four major exchanges, common import issues, and how the CSV maps to HODLTrack's holdings view.

Would love any feedback from people who've wrestled with the same design decision — is auto-sync a dealbreaker for your users, or do people actually accept the manual approach if you explain the tradeoff clearly?

Full guide → How to Import Your Binance, Coinbase & Kraken Transactions into HODLTrack