How to Create an API Key on OKX for Trading Bots?

Accessing the API Management Interface

1. Log into your OKX account using verified credentials and two-factor authentication.

2. Navigate to the “Account” section in the top-right dropdown menu.

3. Select “API Management” from the sidebar navigation panel.

4. Click the “Create API” button located prominently on the dashboard.

5. Confirm your identity via email or SMS if prompted by the security layer.

Configuring API Permissions and Restrictions

1. Choose “Trade” as the primary permission scope for bot operations involving order placement and management.

2. Enable “Read” access to allow retrieval of balance, position, and market data without execution rights.

3. Specify an IP whitelist by entering comma-separated IPv4 addresses or CIDR ranges to restrict API call origins.

4. Set a custom passphrase—distinct from your login password—that will be required for every signed request.

5. Toggle off “Withdrawal” and “Funding” permissions unless explicitly needed for cross-margin or asset transfer logic.

Generating and Securing the Key Pair

1. After submitting the configuration, OKX instantly generates a 36-character UUID-style API Key.

2. A 32-byte hexadecimal Secret Key is displayed only once and cannot be retrieved later—copy it immediately.

3. The system assigns a unique Passphrase that must be stored alongside the other two credentials.

4. All three values—API Key, Secret Key, and Passphrase—are required for every authenticated request.

5. Never commit these values directly into source code; instead use environment variables or encrypted vaults.

Testing the API Connection Locally

1. Initialize a TradeAPI instance using python-okx with the newly created credentials and flag=0 for production mode.

2. Execute a minimal balance query: fundingAPI.get_balances(ccy='USDT') to verify signature validity and endpoint reachability.

3. Monitor HTTP status codes—200 responses confirm successful authentication and routing.

4. Observe rate-limit headers (OK-RLIMIT-LIMIT, OK-RLIMIT-REMAINING) to calibrate bot request frequency.

5. Trigger a dry-run limit order with tdMode='cash' and sz='0.0001' to validate order validation logic without real execution.

Integrating with Python-Based Trading Infrastructure

1. Load credentials via dotenv from a .env file containing OKX_API_KEY, OKX_SECRET_KEY, and OKX_PASSPHRASE entries.

2. Instantiate Trade.TradeAPI with parameters including false for demo mode and proper flag value based on deployment target.

3. Use MarketData.MarketAPI to fetch real-time tickers before order submission to avoid stale price assumptions.

4. Wrap all order placements in try-except blocks catching okx.exceptions.OkxAPIException for granular error handling.

5. Log timestamped request/response payloads to a rotating file buffer for post-execution audit and latency profiling.

Frequently Asked Questions

Q: Can I reuse the same API Key across multiple bots?A: Yes, but each bot should operate under its own dedicated key with tailored IP whitelisting and permission scopes to isolate failure impact.

Q: What happens if my Secret Key is exposed?A: Immediately revoke the compromised key via the API Management interface and generate a new one—no manual intervention from OKX support is required.

Q: Does OKX enforce mandatory passphrase rotation?A: No, but changing the passphrase invalidates all existing signatures and requires full credential reinitialization across all integrated services.

Q: Is WebSocket connection possible with the same API Key?A: Yes—the same credentials authenticate both REST and WebSocket connections, though WebSocket subscriptions require separate topic registration.