What each field on the OKX API key creation form means for your security
The first time you create an API key on OKX, the form can feel like a formality: type a name, choose a passphrase, tick some boxes, maybe add an IP address, confirm. Each of those fields, however, shapes how much damage a leaked key could do. A vague name makes keys hard to audit later. A reused passphrase weakens the key. Unnecessary permissions widen what an attacker could do. A missing IP restriction lets the key be used from anywhere. This walkthrough goes through the form field by field, explaining in plain terms what each one does and how to fill it in safely. Labels may change as the platform updates its interface, so compare with the official help centre if something looks different.
The key name
The name is for you, not for OKX. Use it to describe the tool the key belongs to and the date you created it, for example the tool name followed by the month. When you review keys months later, a clear name lets you decide instantly whether a key is still needed. Avoid generic names such as test or bot, which become meaningless once you have several. Keep a matching note in your password manager recording which service holds each key.
The passphrase
OKX asks you to set a passphrase for each API key. Together with the key and secret, it is needed to authenticate requests. Choose a unique passphrase that you do not use for your account login or anywhere else, and store it in a password manager along with the secret. Never share it in chat or by email. If you lose the passphrase, you generally cannot recover it, so the simplest path is to delete the key and create a new one.
Choosing the permissions
Permissions decide what the key can do. Read access lets a tool view balances and history. Trade access lets it place and cancel orders. Withdrawal access lets it move funds out of your account. Select only what the tool genuinely needs: read-only for portfolio and tax apps, read and trade for trading tools. Leave withdrawal permission off unless you have an exceptional reason and understand the risk. If a tool insists on more access than its purpose requires, consider using a different tool.
IP address restrictions
The IP field limits which internet addresses can use the key. If the tool runs on servers with published fixed addresses, enter them here so the key is rejected from any other location. Keys without restrictions can be used from anywhere if leaked, and the platform may apply different rules to them, such as expiry after a period of inactivity. After saving, paste the secret and passphrase directly into the tool, then review your key list monthly and delete keys you no longer use.
Risk boundary: OKX Trading Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Name each API key after its tool and creation date so you can audit your keys quickly later.
- Set a unique passphrase for every key and store it with the secret in a password manager.
- Grant only read or trade permission as required and leave withdrawal permission switched off.
- Enter the tool's fixed IP addresses in the restriction field and review your key list every month.