A Kraken account can hold more than a current balance. Its records may include completed trades, deposits, withdrawals, conversion activity, fees and ledger entries that are useful for tax reporting, reconciliation and personal record keeping. This guide explains how to export that information safely, when a CSV file is preferable to an API connection, and how to give a tax or portfolio service only the read access it actually needs.
Last reviewed: October 6, 2026. Kraken can change its interface, API labels, available permissions, export formats, eligibility rules and regional services. Confirm the live options displayed in your own Kraken account before creating, changing or sharing an API key. This independent guide is educational and is not tax, legal, investment or cybersecurity advice.
Why Kraken account records need more than a balance screenshot
A balance shows what is present at one moment. It does not necessarily explain how an asset arrived, what price was paid, which fee applied, whether it was transferred from another platform or how a previous sale was completed. A reliable record set needs dates, quantities, transaction identifiers, trading pairs, fees and funding events where available.
This distinction matters when a person uses more than one exchange or wallet. A Kraken withdrawal may be the continuation of an earlier purchase elsewhere, not a taxable sale by itself. Conversely, a trade that leaves the same total dollar value can still be a disposition in a jurisdiction where one cryptoasset exchanged for another creates a reporting event. A tax professional can advise on local rules; the practical task here is to retain complete source data.
CSV export or API connection: choose the right workflow
| Method | Best for | Main advantage | Main limitation |
|---|---|---|---|
| Manual CSV export | A one-time filing, archive or independent review | You control the file and can keep an unchanged copy | New activity is not added automatically |
| Read-only API connection | Ongoing tax, portfolio or reconciliation software | Can retrieve permitted records without sharing your login | Exposes account history to the connected provider |
| Account login shared with a third party | Nothing | None | Exposes password, 2FA and broad account control |
For a historical archive, downloading a CSV from the genuine Kraken account is often the simplest path. Save the original with a clear date and do not edit that source file. A read-only API connection can be useful when a tax tool needs to update repeatedly, but it should be treated as a financial-data permission, not as a harmless convenience setting.
What a read-only Kraken API key can and cannot do
An API key is a credential that lets software communicate with selected parts of an account. The permissions attached to the key determine its boundary. Kraken describes tax-oriented permissions as read-only: they can retrieve account information and history, but do not authorize new trades or funding actions. The exact names and availability can change, so compare every selection with Kraken’s current documentation before saving.
| Permission category | Typical purpose | Appropriate for tax reporting? |
|---|---|---|
| Query Funds | Views balances and funding-related information | Only when the documented connection needs it |
| Query Closed Orders & Trades | Reads completed orders and trades | Usually useful |
| Query Ledger Entries | Reads historical ledger records | Usually useful |
| Export Data | Creates or retrieves supported account-history exports | Useful where required |
| Modify or cancel orders | Places, edits or closes trades | No |
| Withdraw, transfer or address management | Moves assets or changes destinations | No |
Read-only does not mean anonymous or insignificant. Depending on the permissions, a connected service may learn balances, past trade activity, deposits, withdrawals, addresses and timing. Give that access only to a provider you have independently verified, and only for as long as the connection remains useful.
A least-privilege setup for tax software
Least privilege means granting the smallest set of permissions that can complete the intended task. It is safer than turning on every option to avoid a possible import error. Kraken’s tax guidance lists Query Funds, Query Closed Orders & Trades, Query Ledger Entries and Export Data as the common read-only permissions for a tax connection; some integrations may need fewer permissions.
- Open Kraken through a saved bookmark, password-manager entry or verified application.
- Check that your sign-in security and email security are already enabled before opening API settings.
- Create a new, dedicated key rather than reusing one from a trading bot or another service.
- Give it a clear description, such as Tax records read-only 2026.
- Select only the permissions required by the tax provider’s official Kraken instructions.
- Leave all trading, withdrawal, transfer and address-management permissions disabled.
- Record the creation date, purpose and provider in a private key inventory.
- Complete the connection only on the provider’s genuine website or application.
If an importer fails while using the minimum permissions, do not immediately grant a more powerful permission. First check the provider’s official setup guide, the selected date range, the API key status and whether the service supports your Kraken account type. A support agent who asks for your Kraken password, current 2FA code or a withdrawal-enabled API key should be treated as suspicious.
Keep the API key separate from your sign-in credentials
A legitimate API integration should not need your Kraken password or your current two-factor code. The API key exists precisely to avoid sharing those interactive credentials. Treat the public key, private key, secret and any QR representation as sensitive. A screenshot, chat attachment or public repository can expose them as easily as a copied password.
Store a temporary copy only in an encrypted password manager or another secure storage method you control. Do not send a key by email, messenger, screen share or a support ticket. If you pasted it into the wrong website, committed it to code, displayed it in a recording, or cannot confirm where it was saved, revoke it at Kraken and create a new dedicated read-only key only after checking the account.
What changed data permissions can reveal
Permission labels can be more nuanced than they first appear. Kraken notes that its newer funding endpoints consolidate several read-only views under Query Funds. That can mean a read-only connection receives more funding-related visibility than an older integration did. Before retaining an existing connection, review what the provider can see and whether that disclosure still fits your purpose.
Do not confuse visibility with authority. A key that can view a withdrawal history should not be able to create a withdrawal if withdrawal permissions remain disabled. Still, transaction history is sensitive financial information. It may reveal addresses, counterparties, asset holdings and patterns of use, so it deserves the same careful provider review as any other financial-data connection.
Exporting and preserving Kraken transaction history
Exports are useful even when an API sync is active. They give you a dated source record that can be checked later if a third-party service changes its parser, imports a duplicate transaction or loses a connection. Download exports from the Kraken history or export area only after confirming the account domain and selecting the intended report type and period.
- Choose a reporting period that covers the complete tax or review period, including the days immediately before and after a year boundary when needed.
- Export the records relevant to trades, ledger activity and funding history according to the use case.
- Keep the untouched original file in a protected folder with a meaningful name and date.
- Make a working copy if a tax professional or software workflow requires a transformed file.
- Compare the first and last transaction dates, major balances and transaction totals with the Kraken account.
Do not alter an original CSV just to make an import pass. If a tool needs a different format, preserve the source and document any transformation. That makes later troubleshooting possible and helps distinguish an exchange record from a tax-software interpretation.
Reconcile before trusting a calculated gain or loss
A successful import is not proof that every record was understood correctly. Compare a sample of large trades, deposits and withdrawals against Kraken’s own history. Check that the selected timezone, base currency, date range and account type match your intended report. Transfers between your own accounts are a common source of missing cost basis when the original acquisition record exists on another platform.
| Unexpected result | Possible cause | Safe next step |
|---|---|---|
| Balance is higher or lower than expected | Missing wallet, excluded date range, pending data or duplicate import | Compare assets and dates with Kraken before editing records |
| Large gain on an internal transfer | Missing acquisition history or incorrect transfer classification | Locate the original purchase record and seek tax advice if needed |
| Trade date appears shifted | Timezone or export-format interpretation | Check source timestamps and the software’s timezone setting |
| API sync stops updating | Key revoked, permission changed or provider integration changed | Review the key before creating a replacement |
When to revoke or rotate a Kraken API key
Remove a key when you stop using the connected service, change tax providers, suspect a device compromise, see an unfamiliar key, or no longer need ongoing synchronization. Revocation is cleaner than leaving dormant credentials indefinitely. Before revoking a working tax key, export the required records and confirm whether another legitimate workflow depends on it.
After a suspected compromise, work from the outside in: secure the email account, review Kraken sign-in protection and sessions, revoke suspicious API keys, inspect withdrawal addresses and account notifications, then create replacement credentials only on a trusted device. Do not assume that deleting a connection in tax software revokes the Kraken-side key; confirm removal in Kraken’s API settings.
Common Kraken record and API mistakes
- Giving one broad API key to several unrelated apps.
- Enabling trade or withdrawal permissions for a reporting-only task.
- Saving an API secret in a screenshot, plain-text note or chat thread.
- Assuming a current balance is enough to reconstruct transaction history.
- Editing the only copy of an original CSV file.
- Ignoring transfers from external wallets or other exchanges when reviewing cost basis.
- Leaving unused keys active after a tax season or provider change.
- Trusting an email link that claims an API key must be renewed urgently.
Kraken account-data checklist
- Protect Kraken and its recovery email with unique credentials and strong MFA.
- Export and retain original records before relying on an automated calculation.
- Create one clearly named API key for one verified purpose.
- Use only documented read-only permissions for tax or portfolio access.
- Keep trading, withdrawal, transfer and address permissions disabled unless a separate, deliberate workflow needs them.
- Review what data the provider can see before connecting.
- Reconcile important records with Kraken history before filing or relying on a result.
- Revoke unused or suspicious keys from Kraken itself.
Official Kraken documentation
Use these official Kraken pages to confirm the current interface, permission names and account-specific requirements before creating or changing an API key:
- How to use our API for taxes — the read-only permissions Kraken lists for tax-reporting connections.
- API Key Security — permission risks, secure storage and when to remove an unused key.
- How to export account history via API — creating and retrieving trade or ledger-history exports.
- Funding API permission changes — what newer read-only funding permissions can reveal.
Good record keeping does not remove tax obligations, market risk or the need for independent professional advice. It does give you a safer starting point: complete source data, a limited connection instead of a shared login, and an API-key inventory you can review when your tools or circumstances change.