How to use MEXC sub-accounts? (Account Management)

Sub-Account Creation Process

1. Log in to your main MEXC account via desktop or mobile app and navigate to the Account Management section.

2. Select “Sub-Account” from the left-side menu and click “Create Sub-Account”.

3. Enter a unique sub-account name, choose permission level (read-only, trading, or withdrawal), and confirm with your Google Authenticator code.

4. A new sub-account ID appears instantly, along with its dedicated API key interface and asset dashboard.

5. No email verification or KYC re-submission is required for sub-accounts linked to a fully verified master account.

Fund Allocation & Isolation

1. Funds do not auto-transfer between main and sub-accounts; manual transfers must be initiated from the main wallet.

2. Each sub-account maintains independent spot, margin, and futures balances visible only to its assigned permissions.

3. Withdrawal-enabled sub-accounts require whitelisted addresses separately configured under their own security settings.

4. Assets held in a sub-account are legally and technically isolated—no shared liability exists across accounts during internal audits or regulatory reviews.

5. Deposit addresses generated for each sub-account are cryptographically distinct and never reused across sessions.

Permission Granularity

1. Read-only sub-accounts display real-time PnL, order history, and balance data but cannot place orders or initiate withdrawals.

2. Trading sub-accounts support limit, market, stop-market, and conditional orders—but lack withdrawal authority unless explicitly upgraded.

3. Withdrawal permissions require secondary confirmation via SMS or hardware token, enforced regardless of master account settings.

4. API keys issued to sub-accounts inherit only the permissions granted at creation time and cannot be escalated post-issuance.

5. IP binding and geolocation restrictions apply individually per sub-account, independent of the parent account’s login history.

Security Protocols

1. All sub-account logins trigger mandatory 2FA re-authentication—even if the master session remains active.

2. Suspicious activity on any sub-account triggers immediate lockdown of that specific instance without affecting others.

3. Cold wallet signatures for withdrawal requests originate exclusively from sub-account-specific private key shards.

4. Audit logs record every action—including timestamp, IP address, device fingerprint, and permission tier used—retained for 18 months.

5. Sub-account deletion permanently erases all associated API keys, transaction records, and whitelisted addresses with zero recovery window.

API Integration Framework

1. Each sub-account receives a unique API key pair with separate secret keys, rate limits, and endpoint access scopes.

2. REST and WebSocket endpoints enforce strict origin validation, rejecting requests signed with mismatched sub-account credentials.

3. Order placement via API respects sub-account balance caps and prevents cross-account fund utilization.

4. Webhook notifications for fills, cancellations, or balance changes route exclusively to endpoints registered under that sub-account.

5. Signature validation uses HMAC-SHA256 keyed with the sub-account’s individual secret, preventing credential reuse across instances.

Frequently Asked Questions

Q: Can a sub-account trade futures while the main account holds only spot assets?Yes. Futures positions open in a sub-account draw margin exclusively from that sub-account’s USDT or coin-margined balance, irrespective of main account holdings.

Q: Is there a limit to how many sub-accounts one user can create?MEXC allows up to 20 active sub-accounts per verified master account, with no fee for creation or maintenance.

Q: Do sub-accounts share the same referral commission structure as the main account?No. Referral earnings accrue solely to the main account; sub-accounts generate no independent referral income or bonus distribution.

Q: Can I assign different Google Authenticator devices to different sub-accounts?No. All sub-accounts inherit the master account’s single Google Authenticator binding; device-level 2FA separation is not supported.