# Connecting a crypto exchange

> Bitvavo, Coinbase and Kraken connect with read-only API keys and then sync on their own. Here is how to create a key safely and what to do when one stops working.

Crypto exchanges connect through an API key you create yourself. Once connected, balances sync
every 15 minutes without you doing anything.

Gylder currently supports **Bitvavo**, **Coinbase** and **Kraken**.

## Read-only keys, always

Every exchange lets you choose what a key is allowed to do. Give Gylder the narrowest possible
permission: **view balances, nothing else**.

Gylder never places trades and never moves funds, so a key with trading or withdrawal rights grants
access that would go unused. If that key ever leaked, the difference between a view-only key and a
trading key is the difference between someone seeing a balance and someone spending it.

The exact permission names differ by exchange, and they are listed below. The principle does not:
if a permission is not needed to read a balance, turn it off.

## Bitvavo

1. Log in to Bitvavo
2. Go to **Account → API**
3. Create a new key and enable **View** permissions only
4. Disable Trade, Withdraw and everything else
5. Copy the API key and secret into Gylder

**Then check your email.** Bitvavo sends a confirmation link, and the key does not work until you
click it. This is the most common reason a correct Bitvavo key is rejected: Gylder reports invalid
credentials, and the key really is invalid, because it was never activated. If you have just
created a key and it will not connect, look in your inbox before assuming you mistyped it.

## Coinbase

Coinbase uses its **Advanced Trade** API, which issues a different kind of key from the older ones.

1. Log in to Coinbase Advanced Trade
2. Go to **Settings → API → New API Key**
3. Select **View** permissions only, with no trading
4. Copy the **API Key**, which looks like a UUID
5. Copy or download the **Private Key**, which is a block of PEM text
6. Paste both into Gylder

The private key is multi-line and begins with `-----BEGIN`. Paste all of it, including those
delimiter lines.

## Kraken

1. Log in to Kraken
2. Go to **Settings → API**
3. Click **Add key**
4. Under key permissions, enable **Query Funds** and **Query Ledger Entries** only
5. Leave every other permission off, including trading and withdrawals
6. Copy the API key and private key into Gylder

Query Ledger Entries is what lets Gylder read your history rather than only today's balance.
Without it the connection works but has less to build a past from.

## How your key is stored

Exchange credentials are encrypted before they are written to the database, using a key unique to
your account and held in AWS KMS. They are decrypted only in server memory, for the duration of a
single sync, and are never sent to your browser.

If you delete your account, that per-account key is destroyed, which makes the stored credentials
permanently unreadable.

## After connecting

Balances refresh roughly every 15 minutes. Crypto moves quickly and exchange APIs are cheap to
call, which is why this is more frequent than the six-hourly schedule used for bank accounts, where
European rules cap how often we may look without you asking.

Your holdings then behave like any other asset in Gylder: they appear in net worth, in the
diversification donut, and in the investments dashboard alongside securities. See
[position weight](/concepts/position-weight) for how a holding's share of the portfolio is
calculated.

## When a connection stops working

A connection can fail for reasons that have nothing to do with Gylder.

**The key was revoked or expired.** Exchanges expire keys, and some do so after a period of
inactivity. Create a new one and reconnect.

**The key was never activated.** Bitvavo again. See above.

**The permissions are too narrow.** A key that can read balances but not ledger history will
connect and then show less than you expect.

**You changed your exchange password.** Some exchanges invalidate API keys when credentials change.

In each case the fix is the same: create a fresh read-only key and reconnect. Your history in
Gylder is not lost when a key stops working, because it is already stored.

## A note on plans

Connecting an exchange counts as an integration, and how many you can have depends on your plan. If
your trial ends without a subscription, existing connections stay in place but stop syncing, so the
data freezes rather than disappearing.