Connect an exchange with a read-only key

Last updated: 27 October 2026

Qubo can show what you hold on Hyperliquid, Binance, Kraken, Kraken Futures and Coinbase: your spot balances from the Pulse plan, and from Edge your perp account, open positions and their P&L. The connection is read-only: Qubo checks every key when you add it and rejects any key that can trade, transfer or withdraw, so it can never move your funds.

1. How it works

1. Log in to your Qubo account (keys are linked to your account, not to your browser).
2. Open Portfolio, scroll to Platforms and choose the exchange.
3. Create a read-only key on the exchange by following the steps below, then paste it into the API Key and Secret Key fields (plus the passphrase for OKX and Bitget, and the key alone for Bitpanda) and press Connect.

When you press Connect, Qubo asks the exchange which permissions the key has. If it has anything beyond reading, it is refused and never stored. Accepted keys are encrypted on our servers and are never shown again, not even to you. See Security for details.

2. Hyperliquid

Hyperliquid needs no key: its data is public on-chain.

1. On app.hyperliquid.xyz, copy your wallet address (top right, it starts with 0x).
2. In Qubo, choose Hyperliquid, paste the address and press Connect.

Use the address of your main account, not an API or agent wallet: agent wallets hold no balances of their own.

3. Binance

1. Log in on binance.com (desktop is easier) and open Profile › Account › API Management.
2. Press Create API, choose System generated, give it a name such as “Qubo” and confirm with your security checks.
3. Leave only Enable Reading ticked. Do not tick Spot & Margin Trading, Futures, Margin, Withdrawals, Universal Transfer or any other option.
4. For IP access, keep Unrestricted: Qubo reads from servers whose address can change. A read-only key cannot be used to move funds.
5. Copy the API Key and the Secret Key. Binance shows the secret only once.
6. In Qubo, choose Binance, paste both and press Connect.

Qubo reads your Spot and Funding wallets and, from Edge, your USDⓈ-M futures account and positions. Coin-M futures, Earn products and sub-accounts are not shown.

4. Kraken (spot)

1. Log in on kraken.com and open Settings › API (in Kraken Pro: profile icon › Settings › API).
2. Press Create API key and give it a name.
3. Under Funds permissions, tick only Query. Leave Deposit and Withdraw unticked.
4. Under Orders and trades and Other, tick nothing. Keep the other settings as they are.
5. Press Generate key, then copy the API Key and the Private Key.
6. In Qubo, choose Kraken, paste the API key in the first field and the private key in Secret Key, then press Connect.

Balances in staking appear under their usual ticker (for example DOT staked shows as DOT).

5. Kraken Futures

Kraken Futures uses its own keys, separate from Kraken spot. Add it as a second platform if you trade perps there.

1. Log in on futures.kraken.com (or Kraken Pro › Futures) and open Settings › API Keys.
2. Press Create Key. Set access to Read only and withdrawals to No access.
3. Copy the Public Key and the Private Key.
4. In Qubo, choose Kraken Futures, paste the public key in API Key and the private key in Secret Key, then press Connect.

Shown from the Edge plan: the value of your multi-collateral account and your open perp positions.

6. Coinbase

Coinbase keys are created on the Coinbase Developer Platform (CDP), with the same login as your Coinbase account.

1. Open portal.cdp.coinbase.com › API Keys and press Create API key.
2. Give it a name and, under API restrictions, keep only View. Do not tick Trade or Transfer.
3. The signature algorithm can stay as proposed: ECDSA and Ed25519 both work.
4. Press Create and copy the two values shown, or download the key file:
   • the key name (also called API key ID), which looks like organizations/…/apiKeys/…;
   • the private key, which starts with -----BEGIN EC PRIVATE KEY----- (or is a long text for Ed25519). Copy it in full, including the BEGIN and END lines.
5. In Qubo, choose Coinbase, paste the key name in API Key and the private key in Secret Key, then press Connect.

Qubo reads your Coinbase spot balances and, from Edge, perps held in a Coinbase International (INTX) portfolio. US futures (Coinbase Financial Markets) are not shown yet. Older “legacy” Coinbase keys are not supported: create a CDP key.

7. Bybit

1. Log in on bybit.com (or bybit.eu) and open Profile › API.
2. Press Create New Key, choose System-generated API Keys and give it a name.
3. Choose Read-Only. Do not give any trading, transfer or withdrawal permission. For IP access, keep no restriction.
4. Copy the API Key and the API Secret, then paste them in Qubo and press Connect.

Qubo reads your Unified Trading (or Spot) and Funding balances, and the last 12 months of spot trades, deposits and withdrawals.

8. OKX

1. Log in on okx.com and open Profile › API keys, then press Create API key.
2. Give it a name, choose a passphrase and note it: OKX asks for it with every request, so Qubo needs it too.
3. Under permissions, tick only Read. Do not tick Trade or Withdraw.
4. Copy the API Key and the Secret Key. In Qubo, paste them with the passphrase and press Connect.

Qubo reads your trading and funding balances, the last 3 months of spot trades (the most OKX gives) and your deposits and withdrawals.

9. Bitget

1. Log in on bitget.com and open Profile › API Management, then press Create API key › System-generated.
2. Give it a name and a passphrase, and note the passphrase.
3. Choose Read-only. Do not give trading, transfer or withdrawal permissions.
4. Copy the API Key and the Secret Key. In Qubo, paste them with the passphrase and press Connect.

Qubo reads your spot balances and the last 12 months of spot trades, deposits and withdrawals. When you connect, Qubo checks the key by asking Bitget to cancel an order that does not exist: a read-only key is refused by Bitget, and any other answer means the key can trade, so Qubo rejects it.

10. Bitpanda

1. Log in on web.bitpanda.com and open Settings › API Key, then press New key.
2. Tick only Balance and Transaction. Do not tick Trading.
3. Copy the key. Bitpanda gives no secret key: in Qubo, paste the key alone and press Connect.

Qubo reads your crypto wallets, your buys and sells, and your crypto deposits and withdrawals. Stocks, ETFs and metals held on Bitpanda are not shown yet.

11. EVM wallet (MetaMask, Rabby, Ledger…)

1. Copy the public address of your wallet. It starts with 0x and has 42 characters.
2. In Qubo, choose Wallet EVM, paste the address and press Connect.

Qubo reads the balances on Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain, Avalanche, Linea, Scroll and Gnosis, and the history of incoming and outgoing transfers. A swap (one asset out, another in, in the same transaction) counts as a trade. Only well-known tokens are counted, so spam tokens sent to your address are ignored. Gas fees are not read yet.

An address is public: Qubo needs nothing else. Never paste a recovery phrase or a private key, in Qubo or anywhere else.

12. Interactive Brokers (Flex Query)

1. Log in to the IBKR client portal and open Performance & Reports › Flex Queries.
2. Create an Activity Flex Query. Tick the sections Open Positions, Trades and Cash Transactions (all fields), choose the period Last 365 Calendar Days and the format XML, then save. Note the Query ID shown next to the query.
3. In the same page, open Flex Web Service Configuration, enable it and generate a token (choose the longest validity).
4. In Qubo, choose Interactive Brokers, paste the Query ID and the token, and press Connect.

The token can only read statements: it cannot place orders or move money. Qubo reads your stock, ETF and crypto positions with their cost basis, your trades and your cash deposits and withdrawals. US-listed stocks and ETFs are priced live; other markets use the closing price of the IBKR statement (refreshed every 30 minutes at most). Options, futures and cash balances are not shown yet. IBKR positions are left out of the crypto tax report.

13. Brokers by CSV file (Degiro, Trade Republic, Boursorama)

These brokers have no read-only API, so you import a file instead. Any CSV export that lists, for each trade, the ISIN, the quantity and the price (or the amount) works, in French, English or German.

1. Degiro: open Activity › Transactions, choose the period (start from your first trade) and export as CSV.
2. Trade Republic: export your transactions as CSV from your profile, in the app or on the web.
3. Boursorama: in your securities account (PEA or CTO), open the transaction history and export it as CSV.
4. In Qubo, open Portfolio, then Import CSV, and choose the file.

Buys, sells and savings-plan purchases are added to your portfolio; dividends, transfers and interest are skipped. Fees in euros are included in the cost. Importing the same file twice does not duplicate anything, so you can import a newer export at any time. US-listed stocks and ETFs are priced live; other markets keep their ISIN and are valued at the last price found in your files, with its date shown, until your next import. Amounts are converted to dollars at today’s exchange rate. Stocks need the Pulse plan or higher. Imported trades are left out of the crypto tax report.

14. If the key is rejected

Still stuck? Write to support@asterio.app, but never send us a key or a secret.

15. Remove a key

In Qubo, open Portfolio › Platforms and press the remove button next to the account: the encrypted key is deleted from our servers. To be fully certain, also delete the key in the exchange’s API settings.

← Back to Terminalthe app · Full guide