Auditing Which Apps Still Have Access to Your Accounts
Permissions granted once stay granted. A quarterly review takes ten minutes and closes doors nobody remembers opening.
Gabriel Mas ·
Every connection you have ever approved is probably still approved. Most people have more active permissions than they can name.
Step 1: list the exchange API keys
Every venue has an API section. It lists keys, what each can do, and when it was last used.
Look for keys with withdrawal permission. A read-only key is a privacy question; a withdrawal key is an account-emptying question.
Step 2: delete what you do not recognise
If you cannot say what a key is for, it should not exist. Deleting a key in use breaks something visibly and reversibly, which is a cheap way to find out.
Step 3: restrict the ones you keep
Most venues allow a key to be limited by permission and by source address. A key that can only read, from one address, is close to harmless.
Do this for every key you keep rather than only the obvious ones.
Step 4: review wallet connections
Wallet software maintains a list of sites it is connected to, and on some networks a separate list of spending approvals granted to contracts.
Spending approvals are the dangerous category. An approval granted years ago to a site that no longer exists can still be used by whoever controls that contract.
Step 5: revoke stale approvals
Wallets and dedicated tools both offer this. Revoking costs a network fee per approval, which is why people leave them.
Prioritise approvals that are unlimited in amount, which is the common default and the worst case.
Step 6: check the account sessions
Most venues list active logins by device and location. End anything unfamiliar and change the password if something is.
How often
Quarterly, or after any security news involving a service you use. Put it in a calendar, because this is maintenance and maintenance does not happen without a reminder.
What this does not replace
Two-factor authentication and a withdrawal allowlist. Those prevent the attack; this reduces the surface.
A platform with a withdrawal checklist of its own will list every key, session and allowlisted address in one place, which makes the review ten minutes rather than an afternoon. Collect & Exchange keeps that inventory visible rather than scattered, and a venue that confirms the address before sending makes a stolen API key far less useful.