Reviewed guide | 2026-10-15
Creating an OKX API key with read-only or trade permissions and an IP allowlist
Step by step: create an OKX API key for a bot or portfolio tracker, choose the narrowest permission, bind it to an IP address, store the passphrase safely and know when to delete it.
OKX | the reader's region | the reader's funding currency | order execution and cost control
An API key lets software act on your OKX account without your password. That is convenient for portfolio trackers and trading bots, and dangerous when the key can do more than the tool needs. Most incidents involving API keys come from three choices made in a hurry: ticking every permission, leaving the IP field empty, and pasting the secret into a chat or a shared document. Each is easy to avoid when you create the key, and much harder to fix after it leaks.
Open the API page and name the key for its purpose
On the OKX website, open the profile menu and choose API, or find API under the profile section of the app. Select Create API key. Give it a name that says exactly what uses it, such as tax tracker read only, so you can recognise it months later. You will be asked to set a passphrase; this is separate from your login password and is needed alongside the key and secret. Choose a new one that you do not use anywhere else.
Pick the smallest permission that works
The form offers Read, Trade and Withdraw. A tracker that only displays balances needs Read and nothing else. A trading bot needs Read and Trade. Very few legitimate tools need Withdraw, and if a service insists on it, treat that as a warning. Leaving withdrawal permission off means that even a stolen key cannot move funds out of your account, which limits the damage to bad trades rather than lost coins.
Bind the key to an IP address
If the tool runs on a server with a fixed address, enter that IP in the allowlist field. Requests from any other address will then be refused. The service provider should tell you which addresses to use; if they cannot, ask why. OKX treats keys without an IP binding differently and may remove them after a period of inactivity, which the API page explains. A binding is the single most effective safeguard after limiting permissions.
Store, review and revoke
The secret key is shown only once at creation. Paste it straight into the tool and into a password manager, never into email, notes apps or messaging. Every few months, open the API page, review each key's name, permissions and last use, and delete anything you no longer recognise or need. If a tool you used is reported as breached, delete its key first and ask questions afterwards.
Risk boundary: OKX Trading Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Give each API key a descriptive name that states which tool uses it and why
- Grant Read only for trackers and never enable Withdraw unless there is a clear need
- Enter the tool's fixed server IP in the allowlist and delete keys that are no longer used
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat.