Retiring and Rotating Old API Keys: Reading the Rules Beside the Real Screen on OKX
Help articles describe how a feature is supposed to work; the live screen shows how it works for your account today. Gaps between the two are common and worth noticing. This guide compares both views for retiring and rotating old API keys on OKX, in Switzerland, so that you act on what the platform actually shows rather than on an old tutorial. Trading tools, portfolio trackers and bots all ask for API access, and each connection is only as safe as the permissions attached to it and the service that stores the key.
Opening both views side by side
Open the relevant official help page in one window and the account screen in another. Read the help page first, sentence by sentence, and find each element it mentions on the live screen. Third-party tutorials and videos age quickly, so treat them as background only and trust the current official wording.
If you write your own scripts, keep keys out of source code and version control. Use environment variables or a secrets file excluded from backups that sync publicly. Many accidental leaks happen when a script is shared with a friend or uploaded to a public code site with the key still inside.
Spotting misuse early
Never paste a secret key into chat messages, shared documents or support tickets. The secret is shown only once on creation for good reason. Store it in a password manager, and if you suspect it has been exposed anywhere, delete the key and create a new one rather than hoping it was not seen.
Sub-accounts, where offered, add another layer. Running an automated strategy in a sub-account with limited funds caps what a misbehaving tool or stolen key can affect. Check the current help documentation for how sub-accounts and their keys work in your OKX account, because the details differ between platforms.
Restricting where a key can be used
Before connecting a third-party service, find out who operates it, how long it has existed and how it stores keys. Look for a clear explanation of security practices rather than marketing promises. A tool that offers returns that sound too good, or asks you to send funds to it directly, is not a tool but a warning sign.
Use separate keys for separate tools instead of one shared key. If one service is breached, you can revoke its key without disturbing everything else, and the activity logs remain easy to interpret. Shared keys make it impossible to tell which tool did what.
Recording differences you notice
When the screen and the help page disagree, note both versions with the date. The difference may come from a regional setting, an account level or a recent update. Do not guess. Use the help centre or in-app support to clarify, and wait for an answer before taking any action that is hard to reverse.
Risk boundary: OKX Switzerland Guide
Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.
Scenario checkpoint
- Store secret keys only in a password manager, never in chats, documents or source code.
- Review the key list every few months and remove any key you cannot match to a current service.
- Label every key with the tool name and creation date, and delete keys for tools you no longer use.
- Bind keys to fixed IP addresses whenever the tool runs from a known server.
- Read the current official help page beside the live screen and note any difference with the date before acting.