API key hygiene when connecting crypto tax software from Germany

When tax season approaches, many people in Germany connect their exchange accounts to tax software that imports trades automatically. That is a sensible way to save time, and it usually relies on API keys created on Binance, OKX, Bybit or Bitget. The problem appears later. Keys created in a hurry often carry more permissions than needed, are never labelled and stay active long after the software was cancelled. Over a few years, an account can accumulate a collection of forgotten credentials, each of which could be misused if the service holding it were ever compromised. This guide shows how to create keys for tax and reporting tools correctly, store them responsibly and clean them up once the job is done.

Read-only is all a tax tool needs

Importing history requires permission to read account data and nothing else. When creating a key for tax software, leave trading and withdrawal rights disabled. If the software claims it needs more, ask its support to explain in writing, and consider using file exports instead. Some exchanges also let you restrict a key to the importer's published IP addresses; use that option where it is available. Create one key per service and per exchange, so each can be revoked independently without disturbing other integrations.

Name keys so future you understands them

Give every key a label that states the service, its purpose and the date, such as tax import with the year. This seems trivial until you open the API page a year later and find several unnamed keys. Keep a simple list outside the exchange, perhaps in your password manager notes, recording which key belongs to which tool and when you created it. That list doubles as a checklist when you review or revoke keys and makes the annual clean-up a matter of minutes.

Store secrets where they belong

The secret is shown once when the key is created. Paste it directly into the tax software and, if you need to keep a copy, store it in a password manager. Avoid emailing it to yourself, saving it in a spreadsheet or taking a screenshot. Remember that your accountant does not need your API secret; give them exported reports instead. Nobody at an exchange will ever ask you for it either. If you suspect a secret has been exposed, delete the key at once and create a new one.

Revoke after the filing is done

Once your tax return is filed and the software has imported what it needs, consider deleting the keys used for that year. If you will need continuous syncing, keep them but review them quarterly. Also check whether the tax service still holds your keys after you cancel a subscription, and delete them on the exchange side regardless. While on each exchange's API page, look for keys you do not recognise. An unknown key is a reason to change your password and contact official support immediately.

Risk boundary: Germany Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Create tax software API keys with read-only permission and leave trading and withdrawal rights disabled.
• Label each key with the service, purpose and date and keep a matching list in your password manager.
• Share exported reports with your accountant instead of API secrets, and never screenshot a secret.
• Delete tax import keys after filing or review them quarterly if continuous syncing is required.