OKX API permissions recording, key management, and IP whitelist settings are all in one place—the API management dashboard. After logging into your OKX account, click the profile icon in the top-right corner and go to the "API" page. All your created API keys will be listed there.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
This page lets you do three things: check permissions, modify IP whitelist, and view call logs.
Step 1: View existing API key permissions
Check what permissions are assigned to the key you are using—read, trade, withdraw, transfer. Go to the API management page, find the target key in the list, and click "Edit" or view details. The page will show which permissions are currently checked. Goal: You know exactly what the key can and cannot do, e.g., "read-only, no trade or withdrawal rights."
Risk warning: Never enable "withdraw" permission on an API key unless your use case absolutely requires it and you can guarantee the key will never leak. If a key with withdrawal rights falls into the hands of a third-party platform or script, an attacker can directly transfer assets out of your account. Most trading bots and monitoring tools only need "read" or "read + trade" permissions—never withdraw.
Step 2: Check or set the IP whitelist
Check if the API key has an IP whitelist and which IPs are on it. On the edit API key page, find the "IP address whitelist" field. If it's configured, you'll see a list of allowed IP addresses. If it's empty, the key has no IP restrictions and can be called from any network. Goal: You know whether the key restricts source IPs and whether the bound IPs match your expectations.
Case A: Key already has an IP whitelist Only requests from IPs on the whitelist will pass verification; calls from other IPs will directly fail. Each key can have up to 20 IP addresses, separated by commas or spaces.
Case B: Key has no IP whitelist The key can be called from any network. If this key has trade or withdraw permissions, it will be automatically deleted by the system after 14 days of inactivity. Only keys that are bound to an IP or have read-only permissions will not expire.
Step 3: View API call logs
Check the API key's history to see if there are any unusual requests. On the API management page, find a "call log" or similar tab. Filter by time to see each request's path, source IP, and timestamp. Pay close attention to whether paths include abnormal calls involving fund operations. Goal: You confirm that no unauthorized trades or transfers appear in the key's recent call records.
Common reasons for failure
Many people check the "trade" permission right when creating a key, but in reality they only need to read balances and order history. The more permissions you open, the higher the potential loss if the key leaks. Another easily overlooked point: OKX API keys from different regions are not universal; a key created under a specific domain cannot be used across platforms.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Next steps
We recommend you first check all active API keys and turn off any withdraw permissions. If you need to connect a third-party platform, create a separate new key, grant only read and necessary trade permissions, and bind the IP whitelist they provide. After creation, the system will show the Secret Key only once—copy it to a safe place before closing the page.
