Crypto Portfolio Tools: Exchange Connection Study
Verify read-only access, limit permissions, and reconcile API/CSV imports—working connections don't guarantee complete crypto history.
I check permissions and imported records - not just whether a connection works. Before you trust a portfolio tool, confirm read-only access, disable trading and withdrawals, and compare imported dates, amounts, and fees with your exchange statement.
I review 4 connection methods across permissions, history coverage, sync timing, and setup effort:
- Read-only API keys: Can automate imports, but record coverage varies and keys need protection.
- Hosted authorization: Can reduce setup steps, but you still need to check the access granted.
- CSV uploads: Can fill history gaps without live exchange access; overlapping files need duplicate checks.
- Manual entry: Can cover missing records, but requires updates and checks.
My review uses documentation, not hands-on testing, as of October 22, 2026. The sources cover Kryptonim purchase flows - not confirmed portfolio-tracker support or full exchange history. <u>A working connection does not prove complete records.</u> I also flag privacy risks, transfer matching, and the need to verify U.S. account eligibility.
Crypto Portfolio Connections: Verify Access and Records
Connection methods: APIs, authorization, and imports
The trade-off is simple: more automation usually means more permissions. Less access means more manual cleanup.
| Connection method | Automation | Typical data coverage | Security considerations | Beginner setup effort |
|---|---|---|---|---|
| Read-only API key | Scheduled requests; webhooks where supported | Balances, trades, deposits, withdrawals, and quotes | Store credentials carefully and restrict access | Moderate: generate a key and select read-only permissions |
| Hosted authorization | Depends on the access granted | Specific transactions, status, and wallet addresses | Avoids copying secrets in supported flows; review permissions | Low to moderate: follow prompts and approve access |
| CSV upload | Manual export and upload | Historical records included in the export | No continuing exchange access; files may contain sensitive financial data | Moderate: check file compatibility and repeat uploads |
| Manual entry | None | Specific missing transactions or unsupported transaction types | No exchange credentials required; entries still need care | Little technical setup, but work continues over time |
Each method affects what the tool can access, how often records sync, and how much cleanup you’ll need to do.
Read-only API keys and hosted authorization
Check which records the connection imports and whether updates arrive through polling or webhooks. Use historical imports to bring in older activity.
Where supported, hosted authorization lets you connect without sharing a secret directly. Review the requested permissions before approving access.
CSV uploads and manual entries
Imports and manual entries fill gaps when direct connections miss data.
Use CSV files to supplement sync, not replace it. Check the export’s date range, included transaction types, and compatibility with the tool’s importer. You’ll need another export for new activity. Before uploading files with overlapping date ranges, check how the tool detects duplicates so repeated records don’t inflate balances.
Manual entry is a fallback for unsupported transactions, missing history, and corrections. Include the amount, fees, network, and destination address so each entry matches the source record. If the same record later arrives through an API or CSV import, remove the manual entry.
sbb-itb-0796ce6
Read-only access and security risks
Once you choose a connection method, check exactly what access it grants.
Tracking needs read access - not control of your funds. But read-only access can still expose amounts, assets, addresses, networks, and fees.
Limit permissions before connecting
Check the requested permissions, or scopes, against the exchange’s documentation. Grant only read access for records and monitoring. Reject any request for trading, transfers, or withdrawals.
Compare credential and privacy risks
| Method | Money-movement risk | Privacy risk | Credential risk | Recovery action |
|---|---|---|---|---|
| Read-only API key | Read-only record access | Can expose amounts, assets, addresses, networks, and fees | A leaked key can expose permitted records | Revoke the key and review retained data |
| Hosted authorization | Limited to the specific session | Can expose email addresses, wallet addresses, fees, and billing details | Your credentials stay with the provider | End the session and request data deletion |
| CSV upload | No live exchange access is granted | The uploaded file can expose sensitive fields | No exchange credential is required | Remove the file and request deletion of retained records |
| Manual entry | No exchange access is granted | Exposes whatever financial details you enter | No exchange credential is required | Delete the entries |
Revoking access stops future syncs; it doesn’t erase data already shared. If credentials are compromised, revoke them through the provider and review retained data separately. Next, check whether the exchange supports full history, steady sync timing, and easy reconciliation.
Exchange coverage and setup barriers
After limiting permissions, check whether the connection covers the records you need.
Check account support, history, and sync timing
Exchange support matters only if it gives your portfolio tool complete, timely records. Check your exact service and account type - not just the number of exchanges listed. For U.S. accounts, confirm that the integration names the U.S. service, not a similarly named regional service.
The available documentation covers purchase flows, not full exchange history. Undocumented coverage is unverified.
| Service / interface | Connection method | Account scope | Sync method | Documented gaps |
|---|---|---|---|---|
| Kryptonim REST API | API key (X-API-Key) and HMAC-SHA256 signature |
Fiat-to-crypto buy transactions | Transaction status endpoint and webhook notifications | Sell, trade, and rewards history |
| Kryptonim web widget | Hosted widget session | Fiat-to-crypto buy transactions | Webhook notifications and real-time status polling | Test environment limited to USDC, USDT, and MATIC on Polygon |
| Kryptonim web form | Redirect and callback with successUrl / failureUrl |
Fiat-to-crypto purchase records | Success/failure callbacks | Broader exchange history |
A working connection proves access, not complete history. Verify buys, fees, and wallet transfers separately. Missing records or delayed syncs can leave gaps when you reconcile your portfolio.
Set up connections and reconcile records
Create the required key or callback flow, then compare the first import with your statement. Check the earliest imported date, transaction counts, asset quantities, and fees.
Use CSVs only to fill confirmed gaps. Before repeating an export, compare date ranges and transaction IDs so you don't count API records twice.
Review conversions as linked asset movements. Match wallet arrivals to the original purchase and transfer records rather than treating them as new buys. If older records are missing, look for a documented backfill method instead of retrying the sync repeatedly.
Conclusion: limit access and verify records
After comparing connection methods and coverage, check whether the imported record is complete. Read-only API sync works where supported; CSV uploads fill gaps when direct sync isn’t available. Before trusting an import, verify permissions, authentication requirements, and history coverage. The reviewed documentation does not confirm third-party tracker compatibility or user-facing CSV export support.
Checklist: permissions, exports, and complete records
Before relying on a connection, confirm that access is read-only, with trading and withdrawals disabled. Turn on multifactor authentication (MFA), review connected apps, and revoke access you no longer use.
Check that exports include full history, fees, and transfers. Exchange counts alone don’t prove accuracy.
Keep crypto purchases separate from tracking
Buying crypto and tracking a portfolio are separate tasks.
Kryptonim is a fiat-to-crypto purchase service, not a portfolio integration. Its documentation does not establish historical syncing, CSV exports, or tracker compatibility.
U.S. readers should verify current eligibility before buying.
FAQs
Why is my portfolio balance wrong after syncing?
Your portfolio balance may look wrong because of delays, sync errors, or the way the tool handles data. Check that your wallet connected successfully, syncing finished without errors, and you’re viewing the correct wallet address. Also, confirm that the tool supports your tokens and networks.
If you’ve made a recent transaction, allow time for the network to process it and the portfolio to update. Always verify your balance by looking up your wallet address on a blockchain explorer.
How can I spot duplicate imported transactions?
Match each imported transaction’s transactionId against existing records. Keep only one record per ID - transactions with the same transactionId are duplicates.
Before importing again, call GET /v1/transactions/{transactionId}/status to recheck the transaction’s status and details and confirm whether it has already been imported.
What should I do if a tool requests trading access?
Use extreme caution if a tool requests trading access. Legitimate platforms typically need only limited permissions, such as viewing your public wallet address or approving specific transactions. Never share private keys or recovery phrases.
If you suspect excessive permissions or access you didn’t approve have put your wallet at risk, immediately move your assets to a new, secure wallet. Then use permission-revoking tools to remove any application permissions you didn’t approve.