Connecting a portfolio tracker to Bybit with a read-only key and an IP restriction

Portfolio trackers and accounting tools are handy, especially when you need a yearly summary for your commercialista. To pull your Bybit history automatically, they ask you to create an API key and paste it into their app. That key is a credential that works without your password or second factor, so its permissions decide how much damage a leak could cause. For a tracker, the right answer is simple: it should be able to read and nothing else.

Create a dedicated key for each tool

Log in to Bybit on the web, open your profile menu and select API. Choose to create a new key using the system-generated option and give it a name that identifies the tool, such as the tracker's name and the month you created it. Never reuse one key for several services. If one service suffers a breach, you can then revoke only that key and see exactly which tool it belonged to.

Tick read-only and nothing more

On the permissions screen, select read-only. Leave trading, transfers, withdrawals and sub-account management unticked; a tracker needs none of them. Some tools ask for broader permissions during setup, sometimes with the explanation that it makes syncing more reliable. Treat that as a reason to choose a different tool. A key that can trade can be used to move value through manipulated orders even if it cannot withdraw.

Restrict the IP addresses if the tool supports it

Bybit lets you bind a key to specific IP addresses. Reputable trackers publish the server IPs they use to connect, usually in their help documentation. Enter those addresses when creating the key so that it will not work from anywhere else. If the tool does not publish fixed addresses, Bybit may limit how long an unrestricted key remains valid, so note any expiry shown on the API page and plan to renew.

Review and revoke keys on a schedule

Every few months, return to the API page and look at the list of keys. Delete keys for tools you no longer use, and check that the permissions of the remaining ones have not changed. When you delete a key, also remove it from the tool's settings. Store the secret only inside the tool itself, not in emails, notes or screenshots, and create a new key immediately if you suspect it was exposed.

Risk boundary: Bybit Italy Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Create a separate system-generated key for each tracker and name it after the tool.
• Select read-only and leave trading, transfer and withdrawal permissions unticked.
• Bind the key to the tracker's published IP addresses whenever the tool provides them.
• Review the API page regularly and delete keys for tools you no longer use.