# API Key Koinly security **URL:** \ **Category:** Koinly Support\ **Created:** [October 21, 2021, 8:44pm UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078 "2021-10-21T20:44:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Nelson\_V](https://yyz2.discourse-cdn.com/flex052/user_avatar/discuss.koinly.io/nelson_v/32/4971_2.png) [@Nelson\_V](https://discuss.koinly.io/u/Nelson_V)\ **Post date:** [October 21, 2021, 8:44pm UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/1 "2021-10-21T20:44:19Z")
**Describe the problem:** On Oct 12, I generated an API key only for the use on Koinly to gain access to my Kraken account. On that same day within a few hours, Money was withdrawn from my linked checking account to Kraken, and deposited to a completely unknown Kraken account that is not mine. What kind of security is being used to protect our API key information on your end? Do your employess have access to our APi keys? Is there a any way Koinly can do a better job of not letting this happen to other future Koinly customers? \*\*Which exchange/wallet is this regarding?\*\*Kraken **How did you import data into this wallet?** Using an API key **What have you tried to fix this so far?** I called my bank to dispute the money withdrawn from my checking account. This only happened after giving Koinly my API key. The checking acct money withdrawn was not deposited into my Kraken account ---
**Author:** ![killaen](https://yyz2.discourse-cdn.com/flex052/user_avatar/discuss.koinly.io/killaen/32/2568_2.png) [@killaen](https://discuss.koinly.io/u/killaen)\ **Post date:** [October 21, 2021, 9:29pm UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/2 "2021-10-21T21:29:48Z")
how do you know the API key was used to initiate those transactions? I think your biggest issue is when you set up the API key for Koinly or similar services, you need to be very careful about giving it “read-only” access. They shouldn’t even be able to use your API key for any kind of transactions whatsoever. ---
**Author:** ![Nelson\_V](https://yyz2.discourse-cdn.com/flex052/user_avatar/discuss.koinly.io/nelson_v/32/4971_2.png) [@Nelson\_V](https://discuss.koinly.io/u/Nelson_V)\ **Post date:** [October 21, 2021, 11:09pm UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/3 "2021-10-21T23:09:11Z")
Killaen, I appreciate your feedback. I am a newbie, and I believe I didnt give Koinly read only access. My API was only used, given and set up for Koinly and nothing else. Its ironic and suspecious how money was immediately withdrawn from my checking account on Kraken to a different Kraken account that belongs to someone else. I will be more careful about read only access of APIs from now on. I FIRMLY believe Koinly has a customer API security issue with unethtical employees. ---
**Author:** ![killaen](https://yyz2.discourse-cdn.com/flex052/user_avatar/discuss.koinly.io/killaen/32/2568_2.png) [@killaen](https://discuss.koinly.io/u/killaen)\ **Post date:** [October 22, 2021, 1:47am UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/4 "2021-10-22T01:47:21Z")
How are you able to tell that the Kraken account the money went to was someone else’s and not your own? You should also make sure you change your Kraken password and enable 2 Factor authentication for withdrawals/transactions, as you may instead have some sort of keylogger/malware on your computer, and it may not be related to Koinly at all. ---
**Author:** ![Petur\_Koinly](https://yyz2.discourse-cdn.com/flex052/user_avatar/discuss.koinly.io/petur_koinly/32/1155_2.png) [@Petur\_Koinly](https://discuss.koinly.io/u/Petur_Koinly)\ **Post date:** [October 22, 2021, 4:24am UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/5 "2021-10-22T04:24:25Z")
Hi Nelson, See here for a description of Koinly’s security: [How secure is Koinly? | Koinly Help Center](https://help.koinly.io/en/articles/3663348-how-secure-is-koinly) I have just looked at the API documentation for Kraken and there is **no way to deposit money from a checking account by using the API.** See here: [Kraken REST API Documentation](https://docs.kraken.com/rest/) If you are new to using APIs then I would recommend following our guides and only giving the API read permissions. See here for Kraken instructions: [Kraken Tax Statements & Reporting | Koinly](https://koinly.io/integrations/kraken/) Kind regards, Petur ---
**Author:** ![PCN](https://yyz2.discourse-cdn.com/flex052/user_avatar/discuss.koinly.io/pcn/32/4000_2.png) [@PCN](https://discuss.koinly.io/u/PCN)\ **Post date:** [October 23, 2021, 7:27am UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/6 "2021-10-23T07:27:48Z")
When you configure an API key for this kind of service you should disable all permissions but read. Also ¿How do you know your funds were withdrawn trough API? ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex052/uploads/koinly_app/original/1X/7ac58e5593a7122893d066794a7254dcdb5ddb31.png) [@system](https://discuss.koinly.io/u/system)\ **Post date:** [December 22, 2021, 7:28am UTC](https://discuss.koinly.io/t/api-key-koinly-security/8078/7 "2021-12-22T07:28:20Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.