Bring your own data connection.

Prices, charts, public stocks, public perps data and the standard dashboard work without a paid API plan. Cashboard shows an explicit unavailable state when a public provider is rate-limited instead of inventing a value.

The desktop app has a Connections panel with four optional connections. The web build cannot store keys, so a site operator sets provider credentials as deployment variables instead.

• CoinGecko Demo: a Demo API key for higher quote and chart limits. Cashboard supports Demo keys only, not CoinGecko Pro keys.
• Blockscout: an API URL (required), an API key (optional) and one chain. For Blockscout PRO the URL is https://api.blockscout.com/<chain id>. The saved URL and key apply to watch-only EVM portfolios on that one chain, and every other chain keeps using public Blockscout hosts.
• The saved Blockscout key also powers Smart money on Base, Ethereum and Robinhood Chain, whatever URL is saved. Smart money on Robinhood Chain works only with a key, so it works only in the desktop app. Without one the widget says Needs a Blockscout key.
• Coinbase RPC: an RPC URL and a chain. It is a fallback, not a primary route: when Blockscout fails for that chain, the Portfolio widget shows the native balance only, with no price and no tokens.
• Dune: your own Dune API key for the Dune query widget, which runs in the desktop app only. Each read spends credits from your Dune plan.
• DefiLlama public feeds cover stablecoins and yield; bridge volume now requires a DefiLlama paid plan and ETF flows are not included in the current app.
• Broker or trading credentials are not accepted by the current production app.

Several public Blockscout hosts challenge requests that do not come from a browser. As of October 2026 that includes the hosts for Base, Arbitrum One, Polygon PoS and Robinhood Chain. A Blockscout PRO endpoint is the way around it for one chain. Plans and limits are set by CoinGecko, Blockscout and Dune, so check their sites for the current ones.

Step by step: Connections and Blockscout. Where each widget gets its data: Data sources.

Server credentials belong in protected deployment variables. Desktop provider credentials use Electron's operating-system-backed secure storage, are never returned to the renderer after saving and are not saved at all when the system offers only basic text storage. Never place an API secret, private key or seed phrase inside a board, note or imported template.

Lifetime access checkout is live. The server creates each payment request with its route, recipient, token contract or mint, exact amount and expiry. You enter the paying wallet address, and the transfer must come from that wallet. The browser cannot choose the recipient, token contract, amount, success state or confirmation count.

Cashboard verifies the transfer with its own chain RPC. EVM payments on Base and Robinhood Chain need 12 confirmations as of October 2026 and a block at or below the chain's finalized block. Solana payments need the finalized commitment. A transaction can be claimed once, and the server refuses to create a request when its payment store, a chain RPC or the installer release is not ready. See Lifetime access for the buyer's view.