Web3 Wallet & Tools
OKX API Keys: What They Can Do, and How People Lose Money With Them
An API key is a password that never gets typed — which is exactly why leaked keys drain accounts silently. Here's what each permission actually allows, and the settings that limit the damage.
Most people meet API keys when a third-party tool — a portfolio tracker, a tax app, a trading bot — asks for one. The tool's setup guide makes it feel routine: create key, paste, done. What that flow skips is that an API key is a standing credential. It works 24 hours a day, from any server in the world, without ever triggering the login screen or, in many configurations, two-factor authentication.
What an API key actually is
An API key is a machine-to-machine password. Instead of you tapping buttons in the app, a program sends signed requests directly to the exchange. The key (and its secret) prove the request comes from someone you authorised.
The critical concept is permissions. When you create a key on OKX you choose what it may do, and the tiers are very different animals:
| Permission | Allows | Sensible for |
|---|---|---|
| Read | View balances, positions, history | Trackers, tax tools, dashboards |
| Trade | Place and cancel orders | Bots you genuinely trust |
| Withdraw | Move funds out of the account | Almost nothing you'll ever use |
A read-only key that leaks costs you privacy. A trade key that leaks can churn your account or manipulate thin markets against you. A withdraw key that leaks is functionally the same as handing over your funds.
How keys actually leak
The stereotype is a hacker breaking into the exchange. Reality is more mundane:
- The third-party service gets breached. Your key was sitting in their database.
- A "signal bot" or "profit bot" was a scam from day one. The product was collecting keys.
- Keys pasted into chat, cloud notes, or code pushed to a public repository. Automated scanners find exposed keys within minutes.
- Phishing pages that imitate a tool's setup flow. The same trap covered in our account security guide, one layer deeper.
Notice that in every case, the exchange's own security never had to fail.
Configuring a key so a leak survivable
- Grant the minimum permission. A tax tool needs read. It does not need trade, and nothing off-the-shelf needs withdraw.
- Bind the key to an IP address when the tool supports it. A key locked to one server is useless to a thief connecting from anywhere else.
- One key per tool, clearly named. When something looks wrong, you can revoke the one key involved instead of guessing.
- Treat the secret like cash. It is shown once at creation. Anywhere you store it becomes part of your attack surface.
- Review and revoke quarterly. Keys for tools you stopped using are pure risk with zero benefit.
If you suspect a leak
Revoke the key immediately — that kills it at the exchange side no matter who holds a copy. Then check open orders, trade history and withdrawal history for activity you don't recognise, and change your account password as a precaution. Revoking a key does not affect your funds or settings; you can always create a fresh one later.
FAQ
Is it safe to give a well-known app a read-only key? The risk is limited to exposure of your balance and history. That's a real privacy cost, but it cannot move funds. Decide per app, and prefer IP-bound keys.
Do bots need withdrawal permission? No legitimate retail trading bot needs to withdraw your funds. A tool that insists on it is telling you what it plans to do.
Does deleting the app on my phone revoke the key? No. The key lives at the exchange until you revoke it there. Uninstalling the client changes nothing.
Are API keys related to my Web3 wallet? No — a wallet's seed phrase is a different and even more sensitive credential. The comparison is covered in exchange account vs Web3 wallet.
This content is educational only — not financial advice.