Connecting a crypto exchange

Crypto exchanges connect through an API key you create yourself. Once connected, balances sync every 15 minutes without you doing anything.

Gylder currently supports Bitvavo, Coinbase and Kraken.

Read-only keys, always

Every exchange lets you choose what a key is allowed to do. Give Gylder the narrowest possible permission: view balances, nothing else.

Gylder never places trades and never moves funds, so a key with trading or withdrawal rights grants access that would go unused. If that key ever leaked, the difference between a view-only key and a trading key is the difference between someone seeing a balance and someone spending it.

The exact permission names differ by exchange, and they are listed below. The principle does not: if a permission is not needed to read a balance, turn it off.

Bitvavo

Log in to Bitvavo
Go to Account → API
Create a new key and enable View permissions only
Disable Trade, Withdraw and everything else
Copy the API key and secret into Gylder

Then check your email. Bitvavo sends a confirmation link, and the key does not work until you click it. This is the most common reason a correct Bitvavo key is rejected: Gylder reports invalid credentials, and the key really is invalid, because it was never activated. If you have just created a key and it will not connect, look in your inbox before assuming you mistyped it.

Coinbase

Coinbase uses its Advanced Trade API, which issues a different kind of key from the older ones.

Log in to Coinbase Advanced Trade
Go to Settings → API → New API Key
Select View permissions only, with no trading
Copy the API Key, which looks like a UUID
Copy or download the Private Key, which is a block of PEM text
Paste both into Gylder

The private key is multi-line and begins with -----BEGIN. Paste all of it, including those delimiter lines.

Kraken

Log in to Kraken
Go to Settings → API
Click Add key
Under key permissions, enable Query Funds and Query Ledger Entries only
Leave every other permission off, including trading and withdrawals
Copy the API key and private key into Gylder

Query Ledger Entries is what lets Gylder read your history rather than only today's balance. Without it the connection works but has less to build a past from.

How your key is stored

Exchange credentials are encrypted before they are written to the database, using a key unique to your account and held in AWS KMS. They are decrypted only in server memory, for the duration of a single sync, and are never sent to your browser.

If you delete your account, that per-account key is destroyed, which makes the stored credentials permanently unreadable.

After connecting

Balances refresh roughly every 15 minutes. Crypto moves quickly and exchange APIs are cheap to call, which is why this is far more frequent than the daily schedule used for slower accounts.

Your holdings then behave like any other asset in Gylder: they appear in net worth, in the diversification donut, and in the investments dashboard alongside securities. See position weight for how a holding's share of the portfolio is calculated.

When a connection stops working

A connection can fail for reasons that have nothing to do with Gylder.

The key was revoked or expired. Exchanges expire keys, and some do so after a period of inactivity. Create a new one and reconnect.

The key was never activated. Bitvavo again. See above.

The permissions are too narrow. A key that can read balances but not ledger history will connect and then show less than you expect.

You changed your exchange password. Some exchanges invalidate API keys when credentials change.

In each case the fix is the same: create a fresh read-only key and reconnect. Your history in Gylder is not lost when a key stops working, because it is already stored.

A note on plans

Connecting an exchange counts as an integration, and how many you can have depends on your plan. If your trial ends without a subscription, existing connections stay in place but stop syncing, so the data freezes rather than disappearing.