Which Permissions Should a Crypto App Actually Need?

By Gurjeet Singh, developer of CoinPriceAlert · Published 14 August 2026 · 6 min read

Three kinds of permission, three places to check

Crypto apps ask for access in three different places, and people usually check only the first. There are phone permissions, which your operating system asks you to allow. There are exchange permissions, granted when you create an API key and paste it into an app. And there are wallet permissions, granted every time you connect a wallet to a site and sign something.

Each has its own failure mode. A phone permission can let an app read your screen or your text messages. An exchange key can trade your balance. A wallet signature can let a contract spend your tokens indefinitely. The same question applies to all three: does this job actually require this access?

On your phone: what an alert or price app legitimately needs

Notifications, so it can deliver alerts, and network access, so it can reach its servers. That is essentially the complete list. On Android 13 and later, and on every iPhone, notifications are something you grant explicitly; network access is granted automatically.

It does not need your contacts, SMS, call logs, precise location, microphone, files or photos. A camera request can be legitimate in a wallet app, for scanning QR codes of addresses, but not in something that only shows prices. Location is sometimes requested for regional compliance by exchanges, but a price app has no use for it.

Be wary of an app that insists you grant a permission before it will work at all, when the feature it unlocks is optional. Good apps ask at the moment a feature needs something, and still work if you say no.

The Android permissions that should stop you

Accessibility access deserves the most suspicion. It lets an app read what is on the screen and act on your behalf: legitimate for assistive tools, and a well-documented route for banking and crypto malware to read balances, capture recovery phrases as you type them, and approve transactions. A price app, tracker or exchange has no reason to ask for it.

Permission to display over other apps is the second. Malware uses it to draw a fake login screen on top of the real exchange app. Permission to read SMS is the third: it exposes the one-time codes exchanges send by text. And an app asking to install other apps, or telling you to allow installs from unknown sources, is asking to bring in code that has not been through the store's review.

If you already granted one of these to an app you are unsure of, revoke it in system settings, uninstall the app, and change the passwords for any exchange you used on that phone from a different device.

On your exchange: API keys and what to tick

Portfolio trackers, tax tools and bots connect to exchanges with API keys. When you create one, the exchange asks what it may do: typically read account data, trade, and withdraw. A tracker or tax tool needs read access only. A bot needs trading. Nothing you install needs withdrawal permission, and if a tool asks for it, the request itself is the answer.

Trading permission is more dangerous than it looks. A key that can trade but not withdraw can still empty an account, by buying a thinly traded coin from the attacker's own account at an inflated price; Binance's security guidance describes this directly. Restrict every key to the IP addresses of the service using it where the exchange allows, give each tool its own key, and delete keys you no longer use.

And ask whether the tool needs a key at all. Anything that only watches prices runs on public market data. CoinPriceAlert, for example, never asks for an exchange API key, which means there is nothing in it that could trade or withdraw.

In your wallet: connect, approve and sign are different

Connecting a wallet to a site shares your public address and lets the site ask for signatures. On its own it moves nothing. The risk is in what you sign next.

An approval transaction lets a contract spend a token from your wallet, often without limit and with no expiry. A signature request can do the same without any transaction or fee, through permit-style messages. Read every request: if it mentions a spender, an amount or a deadline, you are authorising spending, whatever the button says.

Keep a separate wallet with limited funds for connecting to new sites, review your approvals every few months with a checker such as Revoke.cash or Etherscan's approval page, and revoke what you no longer use.

What a tracker legitimately needs

Public wallet addresses, which are safe to share by design and cannot authorise anything. For exchange balances, either manual entry or a read-only API key with trading and withdrawal both disabled.

A tracker never needs to connect a wallet with signing rights, never needs trading permission on a key, and never needs a recovery phrase to "import" a wallet. If it wants to watch a wallet, the address is enough.

The absolute lines

No app of any kind needs your recovery phrase or private key. Not for verification, not to sync, not to restore, not to claim an airdrop, not to "validate" a wallet. This rule has no legitimate exception, which is what makes it useful: you never have to evaluate the story attached to the request.

No support agent needs your screen, remote access to your computer, or a code sent to your phone. Anyone asking is not support.

And check permissions again after updates. An app that adds a permission in a later version is worth re-examining, because the version you vetted is not the version now running. Both iOS and Android list each app's permissions in settings; a five-minute review every few months catches most problems before they cost anything.

CoinPriceAlert

Never miss a move in the markets you follow

Set the level once and the check runs on our servers, so the alert reaches you with the app closed, on push, Telegram or email, and never at 3am unless you ask.

• Fires about a second after the price hits
• Runs on our servers, so it reaches you with the app closed
• Free for 3 alerts — no card, no account

Download the app for real-time notifications

Frequently asked questions

Price alerts that never need an exchange key or wallet access: crypto price alerts, or every market and alert type. Choosing an app? How the alert apps compare, from their own pricing pages.

Related terms

• exchange API key drains — how a trading-only key still empties an account
• token approvals — the wallet permission that outlives the site
• fake crypto apps — checking an app is real before installing it
• two-factor authentication — why SMS codes are the weakest option

Sources

• Binance Blog: How to use an API key securely, 5 tips from Binance
• Android Developers: Notification runtime permission (Android 13)
• EIP-2612: Permit extension for EIP-20 signed approvals

Keep reading