Managing OKX API keys from the mobile app: create, restrict and revoke on the go

API keys are often created once on a desktop, connected to a tool and forgotten. Yet the moment you most need to manage them, such as when a tool provider announces a breach or you notice strange trades, you may be away from your computer. The OKX app lets you work with API settings from your phone, which makes it possible to react quickly wherever you are. This guide walks through how to approach API keys in the app: creating a key with minimal permissions, checking what each active key can do, binding keys to specific addresses and revoking them immediately when needed. Menus may move as the app updates, so consult the official help centre if a label differs from what you see.

Find the API section in the app

In the OKX app, API management is generally reached through your profile or account settings. Locate it now, before you need it, and note the path. Open the list of keys and check that you recognise each one. Every key should have a label telling you which tool it belongs to and when it was created. If a key has no meaningful name, find out what it is used for or delete it. Knowing where this screen lives turns a potential emergency into a thirty-second task.

Create keys with the least permission

When creating a key from the app, select only the permissions the connected tool really needs. Portfolio and tax tools need read access only. Trading tools may need trade permission, but almost never withdrawal rights. Where the app lets you bind the key to IP addresses, enter the fixed addresses published by the tool provider. Give the key a descriptive label including the tool name and date. The secret will be displayed once; paste it directly into the tool and avoid taking a screenshot on your phone.

Review active keys regularly

Set a monthly reminder to open the API list in the app. For each key, confirm the tool is still in use, the permissions still make sense and the IP restriction is in place where possible. Delete any key belonging to a tool you have stopped using, even if you might return to it later; creating a fresh key takes a minute. While reviewing, also check your login history and device list for anything unusual, since a compromised key sometimes coincides with other account activity.

Revoke immediately when in doubt

If a tool provider reports a security incident, if you accidentally shared a secret, or if you see trades you did not expect, open the app and delete the relevant key straight away. Do not wait to investigate first. After revoking, review recent orders and transfers, then change your password and confirm your second factor if there is any chance the issue goes beyond the key. Contact OKX support through the app if you find unauthorised activity, and never share API secrets with anyone claiming to be support.

Risk boundary: OKX App Safety Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Locate the API management screen in the OKX app now so you can reach it quickly in an emergency.
• Create keys with read-only or trade permission only and bind them to the tool's published IP addresses.
• Label every key with the tool name and date and delete keys for tools you no longer use.
• Revoke a key from your phone immediately if a provider reports a breach or you see unexpected trades.