How to create a read-only Gemini API key

Open Gemini API Settings ↗

We checked these steps against Gemini's own documentation on 25 September 2026. Gemini can rename a button at any time. If a label differs, look for the same permission.

Before you start

• Your Gemini account must be fully verified, or Gemini will not let you create API keys.
• You need the Administrator user role on the Gemini account to create a key.
• Have your passkey, hardware key or authenticator app ready in case Gemini asks for 2FA.

Permissions

Turn on only:

• Auditor

Keep these off:

• Trading
• Fund management

Steps

Sovereign connects to Gemini from one fixed IP address. The connection form in Sovereign shows it next to these steps, with a copy button.

1. Sign in to Gemini on the web and open Settings, then “API”. The link above goes straight there.
2. Click “Create API key”.
3. Under “Scope”, choose “Primary” or another named account, not “Master”, then click the button below it to continue.
4. Untick “Trading”, which Gemini ticks by default, then tick “Auditor” so it is the only role ticked.
5. Leave “Uses a time-based nonce” and “Requires Heartbeat” unticked. A time-based key accepts a nonce in whole seconds only, and Sovereign signs a finer-grained one.
6. Under “IP Allow List”, choose “Trusted IPs Only”.
7. Paste Sovereign's IP address and add it, so it appears in the list of trusted IPs.
8. Copy the “API Key” and “API Secret” as soon as Gemini shows them. The secret is shown only once.
9. Click “Create API key” to finish. If the key and secret appear only now, copy them before closing the window.
10. Paste them into the API KEY and API SECRET fields in Sovereign and press “Connect & Sync”.

Where each value goes in Sovereign:

• API Key (starts with “account-”) → API KEY
• API Secret → API SECRET

Does a Gemini API key expire?

• With an IP restriction: Expires after 180 days without use.
• Without an IP restriction: Expires after 180 days without use.

Sovereign uses the key every six hours while the connection is on, which normally keeps it from counting as unused.

One key covers one Gemini account, so funds in another account need their own key and a separate Sovereign connection. Sovereign reads spot and staking balances only, not derivatives positions and not prediction-market positions — Gemini keeps both outside the balances endpoint this connector reads, so they will not appear in your net worth.

If something goes wrong

• If your API key starts with “master-”: it was made with the “Master” scope, so create a new key with “Scope” set to “Primary”.
• If the first sync fails: check Sovereign's IP was added to the key's trusted list, not just typed; edit the key or create a new one.
• If syncs keep failing with an “InvalidNonce” error: the key was made with “Uses a time-based nonce” ticked. Gemini fixes the nonce mode when the key is created, so create a new key with the option unticked.
• If a working connection stops after Gemini updates its terms: sign in to Gemini on the web and accept the new User Agreement.

Sources

• support.gemini.com/hc/en-us/articles/360031080191-How-do-I-create-an-API-key
• support.gemini.com/hc/en-us/articles/37826759865115-How-to-secure-your-API-Keys-with-Trusted-IPs
• support.gemini.com/hc/en-us/articles/34233843501595-TurboTax
• developer.gemini.com/authentication/api-key