Affiliate disclosure: This article contains an OKX partner link. If you register or trade through it, the site operator may receive compensation. User benefits vary by account, region, VIP tier and campaign; check the sign-up page and My Rewards for the terms actually applied.
In short, an OKX API key is an authentication method that allows an external app or trading bot to read your account information or place orders. When creating one, select only the minimum permissions required for its purpose, link a trusted static IP, and treat the Secret Key and Passphrase as confidential information that cannot be viewed again. Even without withdrawal permission, a compromised Trade-enabled key can cause substantial losses, so revoke any keys you no longer use immediately.
Security and trading risks: An API key is not an automated profit feature. If Trade permission is exposed, assets may be lost through orders at unfavorable prices, excessive leverage, or repeated trading, even without withdrawal permission. Futures API orders carry risks of insufficient margin and forced liquidation, while IP restrictions and 2FA cannot completely eliminate the risks of incorrect permissions or malicious third-party apps. Products, permissions, and screens may vary by region and account.
What Is an OKX API Key?
An OKX API key is a credential that allows a program to send authenticated requests to your OKX account. It generally consists of an API Key, Secret Key, and Passphrase, all of which must match for requests to view private account data or place orders to be approved. Its advantage is that you can create separate keys and permissions for different purposes instead of sharing your password, but granting broad permissions also increases the scope of a potential incident.
The official help center explains that API keys are used by external apps and platforms to access account information and place automated orders. However, available features may vary depending on account type, subaccount, region, product eligibility, and the current screen, so prioritize the OKX screen shown after logging in over the menu names in this article.
Differences Between Read, Trade, and Withdraw Permissions
| Permission | Possible actions · Key risks · Recommended principle |
|---|---|
| Read | Possible actions: View permitted account data, such as balances, orders, and positions Key risks: Exposure of sensitive account information, including assets held and trading strategies Recommended principle: Grant Read only to dashboards that need view access |
| Trade | Possible actions: Submit or cancel orders, transfer funds internally, and change settings, as permitted by the relevant API Key risks: Unauthorized trading, increased leverage, accumulated fees, and liquidation Recommended principle: Grant only to keys that absolutely require automated trading, and consider using a separate subaccount |
| Withdraw | Possible actions: Withdraw through the API Key risks: The greatest risk, as assets may be moved to an external address Recommended principle: Do not grant this permission to a general-purpose trading bot; consider it only when there is a clear business need |
| Transfer, Loan, Earn, etc. | Possible actions: Displayed functions such as transfers between accounts, borrowing and repayment, and Earn subscriptions and redemptions Key risks: Changes to fund allocation outside trading, debt, and product status Recommended principle: Review each permission actually displayed for the account |
Read-only is not risk-free. If balances, order history, and positions are exposed, they may be used for phishing or targeted attacks. Conversely, you cannot assume that a Trade-enabled key is safe just because Withdraw is disabled. Repeated orders on low-liquidity trading pairs or increased futures leverage can cause substantial losses through trading alone.
The OKX API FAQ, updated September 28, 2026, explains the Transfer, Loan, and Earn permissions in detail and notes that these three permissions may be activated automatically for keys that previously had Trade permission enabled, in accordance with that update. Loan and Earn are available only to accounts eligible to use those features. Check the actual permissions of existing keys again in the current API management screen. Do not assume that transfers, loans, or product functions are unavailable based only on the broad permission categories in the technical documentation.
What to Decide Before Creating an API Key
- Purpose: Write down in one sentence whether it is for viewing balances, a trading bot, your own program, or a tax or accounting tool.
- Account scope: Decide whether you need the entire main account or whether a subaccount with segregated funds is sufficient.
- Permissions: Select only the minimum permissions required for the purpose.
- IP: Identify the trusted static public IP used by the program. Do not guess or enter a shared or temporary IP.
- Storage location: Decide how to keep the Key, Secret, and Passphrase out of code, screenshots, messaging apps, and public repositories.
- Revocation criteria: Decide who will delete the key and when if a project ends, a responsible person changes, a suspicious order occurs, or a device is compromised.
A subaccount may help separate a trading strategy from the overall account. However, a subaccount is not insurance against losses, and you should also check internal transfer permissions and how it is linked to the main account. See the OKX Safety and Account Security Guide for security settings across your account.
How to Create an OKX API Key
Steps to Create One on the Website
- Log in to OKX and open Profile → API and connections or the API menu currently shown for your account.
- Select Create API key.
- Enter a key name and confirm the main account or subaccount to link.
- Select the purpose and required permissions.
- If possible, add the program's trusted IP to the allowlist.
- Create a new Passphrase and save it in a password manager.
- Complete 2FA authentication for the OKX account.
- Immediately after creation, save the API Key and Secret Key just once in the designated secure location, then close the screen.
Steps to Create One in the App
The OKX official API FAQ, checked on October 24, 2026, gives the in-app path as Menu → API → Create API key. Depending on the app version and region, the API menu may appear under Tools or another submenu. If you cannot find the menu, do not look for unofficial apps or workarounds; check with official support to confirm the app publisher, update status, and feature availability for your account.
Some regions and accounts may have separate eligibility or asset requirements for issuing API keys. If the feature is not shown, check the official information for your current account and contact customer support; do not deposit unnecessarily or use another region or identity to bypass the requirements for API access.
If the Account field on the API key creation screen is locked, do not assume there is an error. According to the official FAQ, the field may be locked with Main account preselected when a main account has no linked subaccounts.
IP Allowlist and Passphrase Settings
The OKX official API FAQ states that up to 20 IP addresses can be linked to one key, separated by commas or spaces. IP restrictions are an important control that prevents a key from being used on unauthorized networks, but they do not mean you can leave the Secret and Passphrase exposed.
- Check the server's actual static public IP in the infrastructure team's console.
- Do not assume that a personal VPN or frequently changing home IP is a static IP.
- Remove server IPs that are no longer in use immediately.
- Check the domain and support channels to confirm that the IP provided by a third-party bot matches the provider's official documentation.
- Do not reuse the same API key across multiple services.
A Passphrase is not your OKX login password. It is a separate string that you set when creating an API key, and the official FAQ explains that a forgotten Passphrase cannot be recovered. If you lose it, you must delete the existing key and create a new one. Do not store the Secret Key or Passphrase directly in code files, browser autofill, screenshots, or email.
Automatic Deletion After 14 Days of Inactivity
According to the API V5 security documentation, checked on October 24, 2026, a standard API key expires when all of the following conditions are met: no IP is linked, it has Trade or Withdraw permission, and it has been inactive for 14 days. The official FAQ says that the key is automatically deleted in this case. Authenticated API calls for balances, account history, and orders count as activity, but sending the key with a market data API call that does not require authentication does not count as activity.
WebSocket usage is counted only when logging in with the key; do not assume that subscriptions or orders after login refresh the key’s last-used time. The official documentation states that demo trading API keys are exempt from this expiration rule. Check the status and usage history in the current API list and Security Center.
Therefore, do not assume “the key will remain active because I created it”; check its status in the API list in Profile. Conversely, do not rely on automatic deletion as a substitute for security management. If a project has ended or a key may have been exposed, revoke it yourself immediately rather than waiting 14 days. For expiration conditions on read-only or IP-linked keys, prioritize the current account screen and the latest official FAQ.
Examples of least-privilege settings when connecting a trading bot
| Use case | Permissions likely to be needed · Permissions usually not needed · Additional controls |
|---|---|
| Balance and performance dashboard | Permissions likely to be needed: Read Permissions usually not needed: Trade, Withdraw Additional controls: Dedicated key, trusted IP, periodic revocation |
| Spot order bot | Permissions likely to be needed: Read, Trade Permissions usually not needed: Withdraw Additional controls: Trading pair and order limits, separate sub-account |
| Futures order bot | Permissions likely to be needed: Read, Trade Permissions usually not needed: Withdraw Additional controls: Low leverage, verify isolated or cross margin, maximum loss limit |
| Tax and accounting data collection | Permissions likely to be needed: Read Permissions usually not needed: Trade, Withdraw Additional controls: Limit export period, review provider security |
| In-house withdrawal system | Permissions likely to be needed: Consider Withdraw only when required for business purposes Permissions usually not needed: All permissions unrelated to the purpose Additional controls: Address and amount controls, separate account, multi-party approval and monitoring |
Automated futures trading still involves market risk even when the order code works correctly. If you do not understand position direction, account mode, margin type, leverage, and estimated liquidation price, first review the OKX Futures Trading Beginner’s Guide and test the order flow in a demo environment before using real funds.
Calculating API and trading fees
Placing orders through an API does not eliminate trading fees. The applicable fees depend on whether the order is filled as Maker or Taker, the spot or futures product, VIP tier, and account conditions. Automated trading can make it easy to overlook accumulating costs due to frequent orders, so calculate fees separately when assessing strategy performance.
Illustrative calculation: If the notional amount of one side of a fill is 10000 USDT and the illustrative rate is 0.05%, then 0.05% = 0.0005, so the trading fee for one side is 10000 × 0.0005 = 5 USDT. Assuming entries and exits are each filled 100 times at the same amount and rate, the total is 5 × 2 × 100 = 1000 USDT.
This assumes that the notional amount and rate are the same in both directions and that the fee is calculated as USDT; it does not state the actual OKX rate. Actual calculations apply the account’s Maker/Taker rates, actual filled amounts, fee currency, and rounding. For derivatives, fees are not calculated based only on margin; funding fees, spreads, slippage, withdrawal costs, rebates, and trading profit or loss are excluded from the total above.
Referral code benefits and API permissions are separate. Check the applicable fee benefits for code OKDCC on the screen before signing up and in My Rewards after signing up; these may vary by account, region, VIP tier, and campaign. For instructions on how to check, see the OKX Referral Code OKDCC Guide.
Why demo and live trading API keys should be kept separate
The official OKX API FAQ instructs users to create API keys for demo trading through a separate process from live trading keys. Successful requests in a demo environment do not guarantee fills, liquidity, slippage, or profit and loss in a live trading account. Use a dedicated key for the demo environment and apply the x-simulated-trading: 1 header to requests. If you use an SDK, configure its demo settings according to the official documentation as well. The REST host may be shared between live trading and demo, so do not assume they are the same environment just because the address is identical. Check the key, request header, SDK settings, and the site where the account is registered together.
- Use different key names for demo and live trading.
- Indicate the environment in the program startup log, but do not print the Secret.
- Before live trading, double-check order quantity, trading pair, account mode, and leverage limits in both the code and the account.
- Do not use demo results to predict actual returns or guarantee profits.
You can review the order flow and practice limitations for each environment in the OKX Demo Trading Guide. Demo does not support some features, such as deposits and withdrawals, and does not eliminate the possibility of losses in live trading.
Common failures and troubleshooting steps
| Symptom | What to check first · Safe response |
|---|---|
| Authentication failure | What to check first: API Key, Secret, and Passphrase combination; live/demo environment Safe response: Do not print secrets in logs; compare only the key name and environment |
| IP-related rejection | What to check first: Server’s actual public IP and allowlist Safe response: Do not remove restrictions indiscriminately; update only the official infrastructure IPs |
| Insufficient permissions | What to check first: Selected permissions, such as Read or Trade, and the requested feature Safe response: Do not enable Withdraw along with every other permission because of a single error; add only the permissions required |
| Key disappears from the list | What to check first: No IP linked, trading or withdrawal permissions, activity in the last 14 days Safe response: Do not repeatedly submit existing credentials; check the official screen to determine whether a new key is needed |
| Incorrect order direction | What to check first: Account mode and parameters in the current API documentation, such as posSide Safe response: Verify settings in demo mode and with a small amount before retrying in live trading |
| Key/environment errors such as 50101 and 50119 | What to check first: Demo/live trading key and header, account registration site, provider’s official API host Safe response: Do not circumvent this by using an account in another region; check the official documentation or support for your current account |
| Order request timeout, such as 50004 | What to check first: Check whether the order was actually received or filled using the order ID, client order ID, and order history Safe response: Do not immediately resubmit the same order, assuming the first attempt failed |
| Unexpected order | What to check first: Services using the key, active sessions, open orders and positions Safe response: Immediately revoke the key, stop the bot, check orders and positions, and review account security |
Enabling every permission or removing IP restrictions to clear an error message is not a safe solution. Check the request parameters and account mode in the current OKX API documentation, and record only the time, endpoint, and error code of the failed request. Do not post the Key, Secret, Passphrase, or full account response on support forums or public repositories.
If you suspect a key leak or unusual orders
- Immediately delete or revoke the API key in question.
- Stop connected bots and server processes.
- Check open orders, positions, internal transfers, and withdrawal history.
- Review unfamiliar login devices, sessions, Passkeys, and other API keys.
- Review your OKX login password and 2FA status using a secure device.
- Remove secrets from exposed repositories, logs, and messaging apps, but do not reuse a key that has already been exposed.
- If you need a new key, create one with minimum permissions, a new Passphrase, and a trusted IP, then restore connected services one at a time.
- If losses or unauthorized trades are confirmed, preserve evidence that excludes secrets, such as order IDs and timestamps, and contact OKX Official Support.
Deleting a key and managing orders are separate tasks. Do not assume that revoking a key has canceled all open orders or closed positions. Use the official app or website on a trusted device to check the actual status of orders, positions, and internal transfers, and follow the order-management and official support procedures appropriate to the situation. These steps do not guarantee recovery of losses or prevention of further losses.
Pre- and post-issuance checklist
- □ Can you explain the purpose of the key in one sentence?
- □ Have you reviewed the actual detailed permissions, including Read, Trade, Withdraw, and any displayed permissions such as Transfer, Loan, and Earn?
- □ Have you disabled Withdraw for a bot that does not need to make withdrawals?
- □ Have you linked a trusted, actual static IP address?
- □ Have you kept the Secret and Passphrase out of code, screenshots, and messaging apps?
- □ Have you distinguished demo and live-trading keys, request headers, SDK environments, and account registration sites?
- □ Have you set order quantity, trading pairs, leverage, and a maximum loss limit?
- □ Do you regularly delete unused keys and outdated IP addresses?
- □ Have you prepared alerts for unusual orders and a key revocation procedure?
- □ Have you factored fees and funding fees into your strategy's profit and loss?
Frequently asked questions
Do I need an API key if I only trade OKX through the regular app or website?
No. API keys are used to connect external programs, bots, and data tools. They are not required for users who trade directly through the regular OKX app or website.
Can I place orders with Read permission only?
No. According to the official permission definitions, Trade permission is required to submit and cancel orders. Under the principle of least privilege, do not grant Trade to tools that only need to view balances and order history.
Can I retrieve my Secret Key or Passphrase if I forget it?
The official FAQ states that a Passphrase cannot be recovered. If you have not stored your Secret securely or suspect it has been exposed, it is safer to revoke the existing key and create a new one.
Do all OKX API keys expire after 14 days?
No. The conditions—no linked IP, Trade or Withdraw permission, and 14 days of inactivity—apply together. Only authenticated calls and WebSocket logins count as activity according to the official documentation. Demo trading keys are exempt from this expiration rule; check the API list and the latest official documentation for the actual status.
Does a trading bot have to have Withdraw permission?
A bot that only places orders typically operates with Read and Trade permissions. If a third-party service requests Withdraw permission, do not approve it until you have confirmed why it is needed and what controls are in place for withdrawal addresses and amounts.
Can I resend an order request if it times out?
A timeout alone does not confirm that an order failed. As noted in the official API FAQ's 50004 guidance, first check the actual order acceptance and execution status. Compare the order ID or client order ID with the official order history before taking action, and do not immediately resend the same order.
Official sources and review date
- OKX: Subaccounts, Account Mode, and API Connections FAQ — confirmed the displayed update date: August 27, 2026
- OKX API FAQ — confirmed the displayed update date: September 28, 2026
- OKX: How do I enhance my OKX app security? — confirmed the displayed update date: September 22, 2026
- OKX API V5 official documentation — for checking request parameters and the latest endpoints
Final review date: October 24, 2026. API menus, permissions, IP restrictions, deletion of inactive keys, account modes, and product availability requirements may change. Read official facts separately from safe-operating examples from AKEYX, and before taking action, check the logged-in account screen and the latest OKX API documentation.