Is Proof of Trader Safe? Read-Only Keys and Wallet Signatures

Proof of Trader is read-only by design: a wallet is proven with a signature, which is not a transaction and costs no gas, and exchange accounts connect with read-only API keys that you create without trading or withdrawal rights. Keys are encrypted, never sent back to your browser, and the passport can never place orders or move funds. You can disconnect any account, and delete the key on the exchange, whenever you want.

This post explains each part of that, so you can check it yourself before you connect anything to Proof of Trader.

How the wallet signature works

To add a wallet, you sign a message that proves you control it. That is all the signature does.

A message signature is different from a transaction. It is not broadcast to a chain, so it costs no gas. It does not transfer tokens, and it does not grant a spending allowance to any contract. Its only use is to show that the person connecting the wallet holds its key.

Once ownership is proven, the passport reads that wallet's history from public data: perp DEX fills, prediction-market trades and onchain swaps. Nothing is asked of the wallet after that.

One rule worth keeping: read what your wallet asks you to approve. Linking a wallet to the passport is a message to sign. If a prompt ever asks you to send a transaction or approve a token while you are linking a wallet, stop, because that is not what this flow does.

dYdX works the same way: it is linked with a wallet signature.

How read-only API keys work

Centralised exchanges don't expose your trades publicly, so the passport needs a key. Twelve exchanges connect this way: Binance, Bybit, OKX, Bitget, KuCoin, Crypto.com, MEXC, Gate, BloFin, Backpack, Coinbase and Kraken. Several perp and options venues also need a key because there is no public way to read their volume from a wallet: Extended, Paradex, GRVT, ApeX Omni, QFEX, Deribit, Kraken Futures, Hibachi and Aster Pro.

What to tick when you create the key

Every exchange names its permissions differently, but the principle is the same everywhere:

1. Enable read or view permission only. That is what lets the passport see your trade history and balances.
2. Leave trading off. The passport never places orders, so it never needs this.
3. Leave withdrawals off. The passport never moves funds, so it never needs this either.
4. Don't restrict the key to an IP address. This one surprises people. Reads come from Voltrade's servers, not from your computer, so a key limited to your own IP is refused.

Some exchanges also give you a passphrase when you create the key. If they do, the connect form asks for it.

Per-exchange checklist

Menu names change, so we don't reproduce each exchange's screens here. Look for the API management page in your account settings and apply the four rules above.

What happens to your key

Once you submit a key, the passport checks that it can read the account, then imports your trades. Keys are encrypted and never sent back to the browser. That means nobody can open your passport later and copy the key out of the page, including you: if you need to change it, you replace it.

Because the key has no trading or withdrawal rights, it can't be used to place orders or move funds, by Voltrade or by anyone who somehow obtained it. That is why the permission step matters more than anything else in this post. A read-only key is safe because of what the exchange allows it to do, not because of what we promise not to do.

What Voltrade can and can't see

There is also a limit on what the passport can see. Exchange APIs only reach back as far as each exchange keeps history, and that depth is shown per venue when you connect. Older trades on a short-history exchange may not appear.

How to revoke access

You stay in control of every connection:

• In the passport: open the venue and choose Disconnect. Its volume no longer counts toward your record.
• On the exchange: delete the API key from your API management page. Once it is deleted, it can't be used by anyone.
• For a wallet: remove it from your passport. A signature grants nothing ongoing, so there is nothing to revoke on the chain.

Doing both for an exchange is the cleanest option: disconnect in the passport, then delete the key at the source.

One rule to know before you disconnect anything. A wallet or exchange account counts on one passport only, and once a reward is paid on it, that account is bound to that passport for good. This is what stops the same history being claimed twice from two accounts, and it means you can't move a rewarded account to a different passport later.

Privacy on the public board

The passport itself is private. On the public leaderboard you appear only as an anonymous alias with rounded figures, never your name, wallets or socials.

The only public output is the card you choose to download and share. It can show or hide your X picture and name. If you never share a card, nothing about your record is published under your identity.

Why read-only is the whole design

Voltrade has run trading campaigns for venues including dYdX, Lighter, GMX, KuCoin, BloFin and Derive. The passport exists to prove history, and proving history only needs reading it. Every connection is built so the most it can do is read.

For how the record is used once it exists, see What is Proof of Trader?. For how it compares with tools that score public wallet data, see Proof of Trader vs points programmes. If you trade onchain and on Coinbase, Proof of Trader for onchain and Base traders covers that setup. When you are ready, connect at voltrade.xyz/proof-of-trader.

FAQ

Does connecting a wallet to Proof of Trader cost gas?

No. You sign a message to prove the wallet is yours. It is not a transaction, so it is not broadcast to a chain and costs no gas.

Can Proof of Trader withdraw funds or place trades?

No. Wallets are only signed for ownership, and exchange keys should be created with read permission only, with trading and withdrawals off. The passport never places orders or moves funds.

Why shouldn't I restrict my API key to my IP address?

Reads come from Voltrade's servers, not from your device. A key limited to your own IP is refused, so leave the IP restriction empty and rely on read-only permissions instead.

Where are my API keys stored?

Keys are encrypted and never sent back to the browser. To change a key you replace it; you can't view it again through the passport.

How do I remove an exchange from my passport?

Choose Disconnect on that venue in the passport, then delete the key on the exchange. An account a reward has already been paid on stays bound to that passport.

Who can see my trading record?

Only you. On the public leaderboard you appear as an anonymous alias with rounded figures, and only a card you choose to share is public.