Every Bit Works

How to Connect a Kalshi Account to a Portfolio Tracker Safely

Every Bit Works · Sources checked October 5, 2026

Create an API key on Kalshi’s website with the narrowest access the tracker needs; for reporting, that is read-only. Kalshi does not store the private key, so you keep the only copy. Choose a tracker that keeps the key on your device, can’t trade or move funds, and lets you disconnect and delete your data. You can revoke the key on Kalshi at any time.

What the Kalshi API is.

Kalshi provides an API that lets software read your account and, with the right permissions, trade. You create an API key in the API Keys section of your Kalshi profile settings. Kalshi generates a key ID and a private key, and says it does not store the private key: you can’t retrieve it again after leaving the page. Each request is signed with the private key; Kalshi receives the key ID, a timestamp, and the signature, not the private key itself.

Kalshi’s API defines separate permission scopes for reading and writing, including writing trades and transfers. A key with read-only access can view account information but not trade or move money.

What Damage Report accesses.

Damage Report reads the information it needs to show your performance: balances, positions, fills, settlements, deposits, withdrawals, transfers, fees, and market information.

What permissions it requests.

Damage Report’s setup asks you to create a key with Read only access on Kalshi’s website, download the private-key file, and give the app that file and the matching key ID. There is no separate Damage Report account. Step-by-step setup.

What it cannot do.

Damage Report does not place trades, withdraw funds, or otherwise transact on your Kalshi account. It is a reporting and analysis tool.

Where your credentials are stored.

The key file and key ID are stored in the iOS Keychain on your device with a device-only protection class. The private key is used on your device to sign requests sent directly to Kalshi. Your account data is processed and stored locally, and Every Bit Works does not operate a server that receives your credentials or account data. Privacy policy.

How to revoke access.

  1. In Damage Report, leave demo mode if it is on, then choose Settings → Disconnect and Wipe Data and confirm. This removes stored credentials and local account records.
  2. On your Kalshi account page, revoke the API key. This stops the key working anywhere, and doesn’t close your Kalshi account.

Deleting the app alone may not remove Keychain items, so use the in-app wipe first. More on removing your data.

Keep your key private. Never paste a Kalshi password, private key, or key file into a website or send it by email, including to Every Bit Works support. Damage Report only asks for the key file inside the app.

Before connecting any tracker.

  • Does it need write or trading permissions, or only read access?
  • Where is the private key stored: on your device, or on the company’s servers?
  • Is your account data processed locally or uploaded?
  • How do you disconnect it and delete your data?

Primary sources

Sources checked October 5, 2026. Kalshi can change its products, fees, and documents; its current pages take precedence over this guide.