How to Set Up a Read-Only API Key on Bybit: Step by Step
A read-only API key lets portfolio tools access your Bybit data without the ability to trade or withdraw. Here is exactly how to create one safely in under 10 minutes.
Portfolio trackers and analytics tools like SmartViewAI need to read your account data: balances, trade history, and open positions. Rather than entering your login credentials, you create an API key that grants read-only access. A read-only key cannot place trades, withdraw funds, or change your account settings. It is a safe way to connect third-party tools without exposing your account.
Why Would You Need a Read-Only API Key?
Think of it like giving someone a key that only opens a viewing window, not the front door. The tool can see your data and display it in a dashboard. It cannot touch your funds. This is the safest way to connect any external service to your exchange account, and most reputable portfolio tools require exactly this type of key.
Step-by-Step: Creating the Key on Bybit
- Log into your Bybit account and click your profile icon in the top right corner.
- Select API from the dropdown menu.
- Click Create New Key.
- Choose System-generated API Keys, not custom.
- Select the key type as Read-Only. Do not enable trade or withdrawal permissions.
- Give the key a name you will recognise, such as SmartViewAI Portfolio Tracker.
- Under permissions, only check the boxes needed for reading data: Account, Position, and Order History.
- Set an IP restriction if you know the IP address of the service connecting to your account. This adds a meaningful extra layer of security.
- Complete the verification step via email or 2FA as prompted.
- Copy both the API Key and the Secret Key immediately. You will not see the secret again after closing the page.
Where to Store Your API Keys Safely
Only use your API key with trusted, established platforms. Store the key and secret in a password manager if you need to keep a copy. Do not paste your API key into random websites or share it in messages. If your key is ever exposed or compromised, delete it immediately from the Bybit API management page and create a new one.
What to Do If Something Looks Wrong
Check your active API keys regularly from the API management page. Bybit shows the last used time and IP address for each key, which helps you spot anything unusual. If you see a key you do not recognise, revoke it immediately. Treat your API keys like passwords: rotate them occasionally, and never share them with anyone who does not need them.
Enjoyed this article? Put it into practice.
SmartViewAI gives you live portfolio analytics, AI-graded signals, and a built-in academy. All in one place.