How to create a read-only Kraken API key

A key that can read your Kraken balances and nothing else: no trading, no transfers, no withdrawals. These are the steps Sovereign shows when you connect Kraken.

Last updated: 5 November 2026

Open Kraken API settings ↗

We checked these steps against Kraken's own documentation on 5 November 2026. Kraken can rename a button at any time. If a label differs, look for the same permission.

Before you start

If Kraken's Global Settings Lock is on, unlock it first. It blocks new API keys, and unlocking without a Master Key takes at least 24 hours.

Permissions

Turn on only:

Funds → Query Funds

Keep these off:

Withdraw
Add withdrawal addresses
Earn
Create & modify orders
Cancel & close orders

Steps

Sovereign connects to Kraken from one fixed IP address. The connection form in Sovereign shows it next to these steps, with a copy button.

Click “Open Kraken API settings” and sign in to Kraken.
Click “Create API key” in the spot trading section, not the futures one.
If Kraken asks for an “API type”, keep “Standard”.
In “Name”, type a name none of your other keys use, such as Sovereign.
Under “Funds”, tick “Query Funds”.
Leave every other box unticked, keep “Key Expiration” off, and don't add 2FA to this key.
Turn on “IP Address Restriction” and paste Sovereign's IP address.
Click “Generate key” and complete any security check Kraken shows.
Before closing Kraken's window, paste the “API key” into API KEY and the “Private key” into API SECRET in Sovereign, then press “Connect & Sync”.

Where each value goes in Sovereign:

“API key” → API KEY
“Private key” → API SECRET

Does a Kraken API key expire?

With an IP restriction: No expiry date, as long as “Key Expiration” stays off.
Without an IP restriction: No expiry date, as long as “Key Expiration” stays off.
If unused: Kraken may disable keys left unused for several months.

Sovereign uses the key every six hours while the connection is on.

One setting we ask you to switch off: Per-key two-factor authentication (“Edit 2FA” on the key's row). Kraken's per-key 2FA requires a one-time code in every private request. A scheduled background sync has nobody to ask for it, so a key with it on can never be used unattended.

The steps and permissions above are the SPOT key, which syncs your spot, Earn and staked balances. Each Kraken sub-account needs its own key and connection. · KRAKEN FUTURES is a second, separate key: Kraken issues it on its derivatives platform, not the page above. Create it with “General API” set to “Read only” and “Withdrawal API” to “No access”, add Sovereign's IP, then paste its “Public key” into API KEY and its “Private key” into API SECRET as a SECOND Kraken connection in Sovereign. Do not add futures permissions to the spot key — they do not exist there, and one key cannot cover both platforms.

If something goes wrong

If the connection reports a key problem: check the key has no 2FA. On the key's row choose “Edit 2FA”, then “Disable 2FA”.
If you closed Kraken's window before copying: delete that key and create a new one. Kraken never shows the keys again.
If you already have a Kraken key: create a new one just for Sovereign. Sharing a key between apps causes errors.
If no balances appear: check the key has “Query Funds” ticked under “Funds”.

Which permissions does a read-only Kraken API key need?

Turn on: Funds → Query Funds. Keep off: Withdraw; Add withdrawal addresses; Earn; Create & modify orders; Cancel & close orders.

Can Sovereign trade or withdraw with my Kraken key?

No. Sovereign's code does not trade or move funds: it reads balances and positions. A key made with this guide also has no trading, transfer or withdrawal permission, so Kraken itself refuses such a request.

Sources

Sovereign tracks Kraken next to your other exchanges, brokers, wallets and property, in one net worth. Start free or see how we store keys. Guides for other providers: all read-only API key guides.