Portfolio tracker without connecting your broker

Every portfolio tracker needs your positions. There are three ways to hand them over, and they differ enormously in what the tracker holds afterwards — from a standing key to your account, down to a file and nothing else.

“Connect your broker” is one button covering three unrelated mechanisms. It is worth knowing which one you are pressing.

The three mechanisms

Credential sharing

You type your broker username and password into a third-party site, which then logs in as you and reads the screen. Some aggregators still work this way where no API exists.

The credential you have handed over carries every permission your own login has, including placing orders and, at some brokers, withdrawing to a linked account. It cannot be revoked without changing your password everywhere, and it is a breach of the terms of service at most brokers — which matters beyond the principle, because it is generally the clause that voids their liability if something goes wrong on your account.

Read-only API keys

You generate a key inside your broker account, scoped to reading, and paste that into the tracker. The broker issued it, the broker limits it, and you can destroy it from your broker account without touching your password.

This is a genuinely reasonable mechanism and it is what a well-built integration uses. Two things stay true anyway: the tracker holds a credential that keeps working until you revoke it, so a breach on their side exposes your positions until you act; and scope depends on the broker actually offering read-only keys. Some issue one key with every permission attached, in which case “read-only” describes the tracker’s intentions rather than an enforced limit.

CSV export

You download your transaction history from your broker and upload the file. Nothing connects to anything. The tracker holds a file and no credential, so there is no standing access to revoke and nothing to breach beyond the data itself.

The cost is real and worth stating plainly: it does not update itself. Make ten trades and your tracker knows about none of them until you export again. For an active trader that is a genuine drawback. For someone who buys monthly and holds, it is a few minutes every few weeks.

What about open banking?

PSD2 open banking in the EU is a regulated framework with licensed providers, explicit consent and a 90-day expiry — a real improvement over credential sharing, and the mechanism behind most legitimate bank aggregation.

It mostly does not cover brokerage accounts. It was written for payment accounts, and investment accounts sit outside its scope at most institutions. A tracker offering an open banking connection is generally reading your current account rather than your portfolio.

Questions worth asking before connecting anything

• Can I revoke this from my broker, without changing my password? If no, it is credential sharing whatever it is called.
• Does my broker’s API offer read-only scope? If it issues one key with trading attached, the restriction is a promise rather than a limit.
• What breaks if this company is breached tonight? A file from March, a live view of your positions, or your account.
• Does my broker’s terms of service permit it? Worth reading the clause about sharing credentials before, not after.
• Can I get my data out? Any tracker that ingests your history and will not export it has made leaving costly by design.

Why transactions beat a snapshot

A detail that matters more than the connection method: whether the tracker receives your transactions or only your current positions.

A snapshot says you hold 40 shares of something at today’s price. It cannot tell you what you paid, when you bought, what the position has returned, or what it has paid in dividends — that history is not in the snapshot and cannot be recovered from it.

A transaction history contains all of it, which is why a CSV of transactions is a richer input than a live connection reading balances. It is also why the return figures differ so much between trackers: one is reconstructing from a dated history, another is reading a balance and guessing at cost basis.

Choosing

There is no single correct answer, and it depends mostly on how often you trade.

• Frequent trading: re-uploading a file weekly gets old. A read-only API key from a broker that genuinely scopes it is the proportionate mechanism.
• Buy and hold, contributing monthly: a CSV every few weeks is little effort, and it is the only method where a breach at the tracker exposes no access to your account.
• Credential sharing: against your broker’s terms, unrevokable, and carrying trading permission. There is no portfolio chart that needs that much access.