Giving an OKX trading bot an API key without handing it your withdrawals

Automated trading tools are widely advertised, and many of them connect to OKX through an API key. The convenience is real, but so is the exposure. A bot needs enough access to read your balances and place and cancel orders. Anything beyond that is risk you accept for no benefit. The most damaging scenario is a key with withdrawal rights falling into the wrong hands, whether through a breach at the bot provider, a compromised server or a careless copy and paste. The steps in this guide narrow what a key can do and limit where it can be used, so that even if something goes wrong, the damage stays contained. Treat any bot as an experiment, start small, and remember that automation does not remove market risk.

Grant read and trade, never withdraw

When creating the key, enable only the permissions the bot documents as necessary, which for most trading tools means reading account data and trading. Leave withdrawal permission off. If a provider says it needs withdrawal access, ask why in writing and be prepared to walk away; legitimate trading strategies do not require the ability to send funds out of your account. Give the key a descriptive name that includes the bot and the date so you can identify it instantly later. One key per bot keeps problems isolated.

Bind the key to the bot's IP addresses

OKX allows API keys to be restricted to specific IP addresses. Reputable bot providers publish the addresses their servers use, and some let you run the bot on your own server with a fixed address. Enter those addresses when creating the key so that requests from anywhere else are rejected. A key without IP binding can be used from any location if it leaks. If the provider cannot give you fixed addresses, treat that as a signal to be more cautious about the amount of capital you expose to the tool.

Isolate the bot in a sub-account

Consider creating a sub-account dedicated to the bot and moving into it only the capital you are willing to let the strategy manage. The API key is then created for that sub-account, so the bot cannot see or touch funds held in your main account. This structure also makes performance easier to measure, because the sub-account's history reflects only the bot's activity. Review the official help centre for how sub-accounts and their keys work, including how transfers between accounts are authorised.

Monitor, rotate and remove

Check the bot's trades regularly rather than assuming it is behaving as described. Look for unexpected pairs, unusual order sizes or activity at times the strategy should be idle. Rotate keys periodically by creating a new one and deleting the old. If you stop using a bot, delete its key the same day instead of leaving it dormant. Store secrets in a password manager, never in chat messages or screenshots, and remember that OKX staff will never ask you to share an API secret.

Risk boundary: OKX Referral Terms Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Create bot API keys with read and trade permissions only and keep withdrawal permission switched off.
• Bind each key to the fixed IP addresses published by the bot provider or your own server.
• Run the bot from a dedicated sub-account holding only the capital you are willing to let it manage.
• Review the bot's trades regularly for unexpected pairs, sizes or activity outside its normal schedule.
• Delete a bot's API key the same day you stop using it and rotate active keys on a regular schedule.