Keys and settings

What works without keys#

• Public wallet balances on Ethereum, Base, Arbitrum One, BNB Chain, Robinhood Chain and Solana.
• For each of those networks except Solana, Holdings checks the network's own coin and a short list of well-known tokens, shown in the table below.
• Holdings prices these tokens with DefiLlama, and it counts a DefiLlama price only when DefiLlama reports a confidence of 0.9 or higher and the price is less than an hour old. If no such price is available, ETH is priced at the WETH rate and USDC is counted at $1. Each price is labeled with where it came from.
• On Solana, Holdings reads SOL and the Solana tokens it supports.
• The market strip and charts use public Kraken quotes and one Ethereum Uniswap pool through GeckoTerminal.
• Security checks you start yourself cover scam tokens, token approvals, DeFi hack alerts and stablecoin peg warnings.
• The demo uses fictional data and needs no setup at all.

Tokens outside this list do not appear without a key. Add a Zerion key to see every token in a wallet.

Optional keys#

Each key is optional and turns on one source. Exchange keys come in two halves, so add the key and its secret together.

How the Portfolio total is counted#

The Portfolio shows one total for everything you have added, with your wallets and your exchanges listed beside it. Holdings counts each holding once.

• Without a Zerion key, each wallet is counted from the short public token list above, priced with DefiLlama.
• When Zerion loads the tokens for a wallet, Zerion's verified list replaces the public list for that wallet, so a token is never added from both. If Zerion cannot load, Holdings goes back to the public list.
• Exchange balances are priced with each exchange's own public prices and added to the total. USDC and USDT are counted at $1 and labeled that way.
• A token or coin without a recent, trusted price shows as No price yet, and it is left out of the total until it has one.
• DeFi positions and NFTs are listed on their own pages but are not added. A DeFi position can hold tokens that are already counted in your wallet, so adding it could count the same money twice, and an NFT price is only an estimate from recent sales.

On the Portfolio page, open How this is counted under the total to see the rules for your own wallets and which tokens have no price yet.

Where to enter keys#

1. Open the Holdings settings in Hermes.

   In Hermes, open Capabilities, then Plugins, then Holdings and its settings.

2. Paste each exchange, Zerion or Etherscan key into its labeled field.

   Use the same Hermes profile that you use for Holdings. Hermes stores the values and hands each one to Holdings only for the request that needs it. The Holdings key is not entered here.

3. Go back to Holdings and load the source.

   Use Sources to read exchange balances, or Wallets & DeFi to load Zerion data for a wallet.

Safe settings for exchange keys#

Holdings only needs to see your exchange accounts. When you create a key, give it view or read access and leave trading and withdrawals switched off. That way the key cannot move funds even if someone else gets hold of it.

If a key has more access than Holdings needs, it still works. Holdings shows a warning so you can tighten the permissions at the exchange.

The Holdings key#

Alert watch and saved live reviews keep their data on this computer in encrypted files. The Holdings key unlocks them. This setup is optional and advanced. Holdings works without it, and only Alert watch and saved reviews need it.

Exchange, Zerion and Etherscan keys go in the Hermes plugin settings. The Holdings key is not entered there. You set it up once with the copy-paste blocks below, using your Mac Keychain, a Linux secret store or 1Password. Hermes reads the key at startup and hands it to Holdings. Holdings never reads your Keychain or keyring itself.

On a Mac

Open Terminal and paste the first block. It makes a random key and saves it in your login Keychain. It prints nothing when it works. If a Holdings key is already there, it keeps that key and says so, because replacing it would lock your saved alerts.

security find-generic-password -s hermes-holdings-vault-key >/dev/null 2>&1 \
  && echo "A Holdings key is already in your Keychain, so Holdings kept it." \
  || printf 'add-generic-password -a %s -s hermes-holdings-vault-key -w %s\n' "$USER" "$(openssl rand -base64 32)" | security -i >/dev/null

Paste the second block. It tells Hermes to read the key from your Keychain each time Hermes starts.

hermes config set secrets.command.command 'k=$(security find-generic-password -s hermes-holdings-vault-key -w) && printf "HOLDINGS_VAULT_KEY=%s\n" "$k"'
hermes config set secrets.command.override_existing true
hermes config set secrets.command.helper_timeout_seconds 3
hermes config set secrets.command.enabled true

Restart the Hermes gateway so it runs the helper again. Quitting Hermes Desktop is not enough, because the gateway keeps running in the background after Desktop closes.

hermes gateway restart --detach

Then run the check, which should print PASSED.

hermes holdings-storage check

Open Holdings, then Alerts. If it still says Alert watch is locked, choose Check again. When it opens, choose the wallets to watch and turn on Alert watch.

If macOS asks whether security may use the item, choose Always Allow. Hermes gives the helper 3 seconds and cannot answer a prompt. If you use a named Hermes profile, add --profile NAME after each hermes word.

On Linux

These blocks use secret-tool from libsecret with GNOME Keyring or KWallet. Your keyring must be unlocked when the gateway starts.

secret-tool lookup service hermes-holdings-vault-key >/dev/null 2>&1 \
  && echo "A Holdings key is already in your keyring, so Holdings kept it." \
  || openssl rand -base64 32 | tr -d '\n' | secret-tool store --label="Hermes Holdings key" service hermes-holdings-vault-key

hermes config set secrets.command.command 'k=$(secret-tool lookup service hermes-holdings-vault-key) && printf "HOLDINGS_VAULT_KEY=%s\n" "$k"'
hermes config set secrets.command.override_existing true
hermes config set secrets.command.helper_timeout_seconds 3
hermes config set secrets.command.enabled true

Then restart the gateway, run the check, and open Holdings, then Alerts.

hermes gateway restart --detach

hermes holdings-storage check

With 1Password

Use this path if you already use the 1Password CLI with Hermes. The first command sets up the Hermes 1Password source. The second makes the key in your Private vault. The third maps the key for Hermes.

hermes secrets onepassword setup
op item get "Hermes Holdings key" --vault Private >/dev/null 2>&1 \
  || printf '{"title":"Hermes Holdings key","category":"PASSWORD","fields":[{"id":"password","type":"CONCEALED","purpose":"PASSWORD","label":"password","value":"%s"}]}' "$(openssl rand -base64 32)" | op item create --vault Private - >/dev/null
hermes secrets onepassword set HOLDINGS_VAULT_KEY "op://Private/Hermes Holdings key/password"

Then restart the gateway, run the check, and open Holdings, then Alerts.

hermes gateway restart --detach

hermes holdings-storage check

Holdings does not accept the key from the Hermes Bitwarden source. Bitwarden users can use the command helper with their own non-interactive CLI instead.

Keep a secure backup of the key. If it is lost or replaced, Holdings cannot open reviews or alerts that were saved with the old one. Moving to a new computer means moving the key with your Hermes profile.

Sharing private data with chat#

One setting is a switch rather than a key. Allow private portfolio data in Holdings chat tools is off by default. Turn it on only for a profile where you are happy for your Hermes model to see saved private data, because a hosted model can receive what the tools return.