The three permissions
- •Read: lets the system see balances, positions and orders. Required — without it the system is blind.
- •Trade (Spot / Futures): lets the system place and cancel orders. Required to actually run a strategy. Make sure you grant the type your system uses (a Spot-only key can't trade futures).
- •Withdraw: lets the key move funds off the exchange. A trading system never needs this. Keep it OFF.
Why withdrawal off is non-negotiable
An API key is a credential that can leak — from your clipboard, a screenshot, a compromised machine. If the key has no withdrawal permission, the worst an attacker can do is trade your account; they cannot steal your coins. That single setting is your biggest protection.
Extra hardening
- •IP whitelist: bind the key to TalixTrade's server IPs so it's useless from anywhere else. Effectively required on OKX for stable operation.
- •One key per purpose: a dedicated system key is easy to revoke without touching your other integrations.
- •Rotate if exposed: if a key ever appears somewhere it shouldn't, delete it on the exchange and create a new one. There's no downside to rotating.
Quick checklist
- Read — ON
- Trade (matching your system's market) — ON
- Withdraw — OFF
- IP whitelist — ON where supported