The available permissions differ on each exchange. Portfolio-only exchanges must have "read" permission granted to the API key (basically, permission to see your account). Permissions to withdraw, deposit, create or cancel orders and more are not required for Portfolio-only exchanges.