I know this is an old post but for the benefit of those finding it, I'll go ahead and answer. Yes it is a risk to use the key for cointracking. But you can select when setting up the api to only be read only. So they have no permission to trade or make changes. Other exchanges you have to choose complete acces or none at all. But for these, cointracking deletes the key and you have to enter it any time you want it to access your exchange. So the risk is minimized. Cointracking is the oldest and most solid program available, so the risk is minimal. Hope that helps.