OKX API key permissions for a bot
OKX's API FAQ names the three permissions and says trade or withdrawal keys with no IP binding are deleted after 14 days of inactivity.
Permissions
The FAQ (OKX API FAQ) says you can edit a key's name, its permissions (Read, Trade, Withdraw) and its bound IP addresses, and that you can delete the key. A bot that only reads the account needs Read. A bot that places orders needs Trade. It does not need Withdraw.
Withdrawals
Withdraw is a separate permission on that screen. Leave it off for any key you put in a bot or an agent. The FAQ also describes a Transfer permission that moves funds between your own accounts. A market bot does not need that either.
IP allowlist
Keys that are not bound to an IP and that have transaction or withdrawal permissions are deleted after 14 days of inactivity. Calling a private endpoint, such as balance, bills or orders, counts as activity. The FAQ says only read-only keys bound to an IP, or keys with specific permissions, will not expire. Bind the bot's server IP anyway.
Sub-accounts
The same FAQ says that, for master accounts or sub-accounts, only accounts with assets under management over 100 USD can create API keys, and that this applies only in certain areas.
How to revoke
The FAQ says to delete the key if it is no longer needed, and that you cannot view the passphrase again after it is created. If the passphrase or the secret leaks, delete the key and create a new one. You cannot recover the old passphrase.
Worst case for your money, and the safe setup: OKX check.
Listing, with the safety facts we track: OKX.
Same rules, other exchanges: API key safety. Exchange directory: crypto exchanges for bots.
More in this set
Questions
What OKX API permissions does a trading bot need?
Read, and Trade if it places orders. Leave Withdraw off. Transfer, which moves funds between your accounts, is also separate and not needed for a market bot.
Do OKX API keys expire?
Keys with trade or withdrawal permission and no IP binding are deleted after 14 days without a private API call. Bind an IP.