# Auditing Which Apps Still Have Access to Your Accounts

> Permissions granted once stay granted. A quarterly review takes ten minutes and closes doors nobody remembers opening.

- Source: https://thecoinworkbook.com/auditing-app-access/
- Published: 2026-10-08
- Author: Gabriel Mas
- Publication: The Coin Workbook — Do it once, with the steps written down
- Topic: custody
- Tags: custody, security, maintenance

---

Every connection you have ever approved is probably still approved. Most people have more active permissions than they can name.

## Step 1: list the exchange API keys

Every venue has an API section. It lists keys, what each can do, and when it was last used.

Look for keys with withdrawal permission. A read-only key is a privacy question; a withdrawal key is an account-emptying question.

## Step 2: delete what you do not recognise

If you cannot say what a key is for, it should not exist. Deleting a key in use breaks something visibly and reversibly, which is a cheap way to find out.

## Step 3: restrict the ones you keep

Most venues allow a key to be limited by permission and by source address. A key that can only read, from one address, is close to harmless.

Do this for every key you keep rather than only the obvious ones.

## Step 4: review wallet connections

Wallet software maintains a list of sites it is connected to, and on some networks a separate list of spending approvals granted to contracts.

Spending approvals are the dangerous category. An approval granted years ago to a site that no longer exists can still be used by whoever controls that contract.

## Step 5: revoke stale approvals

Wallets and dedicated tools both offer this. Revoking costs a network fee per approval, which is why people leave them.

Prioritise approvals that are unlimited in amount, which is the common default and the worst case.

## Step 6: check the account sessions

Most venues list active logins by device and location. End anything unfamiliar and change the password if something is.

## How often

Quarterly, or after any security news involving a service you use. Put it in a calendar, because this is maintenance and maintenance does not happen without a reminder.

## What this does not replace

Two-factor authentication and a withdrawal allowlist. Those prevent the attack; this reduces the surface.

[A platform with a withdrawal checklist of its own](https://collectnexchange.cy/compliance/cysec-licensed) will list every key, session and allowlisted address in one place, which makes the review ten minutes rather than an afternoon. [Collect & Exchange](https://collectnexchange.cy/) keeps that inventory visible rather than scattered, and [a venue that confirms the address before sending](https://collectnexchange.cy/services/crypto-offramp) makes a stolen API key far less useful.

---

This article explains how something works. It is not financial advice.
Canonical HTML version: https://thecoinworkbook.com/auditing-app-access/