Interactive tool · self-check
Quant has to hand part of your account's controls to an API, and it's also the step where beginners most often lose funds. Before you wire a script up to the exchange, tick through the points below one by one — ticks are counted live in your browser only, not saved, not uploaded, and reset to zero when you close the page.
A quant script only needs to place orders and query — it never touches withdrawal. As long as the key has no withdraw permission, even if your apiKey, Secret and Passphrase trio all leaked one day, whoever got them could at most place wild orders in your account (already bad), but could not move your coins out. Tick withdrawal and a leak is like handing over the keys to your safe. Get this one wrong and nothing else below matters.
Running quant over an API means handing part of your account's controls to a stretch of script and a pair of keys. Unlike a login password, API credentials are made for a program to use, so they have more ways to leak — logs, screenshots, an accidental push to a public repo. That makes the security setup at the key-creation step more worth your time than the strategy itself, because it decides "how bad the worst case can get."
Of the seven, the real floor is the ones marked "Critical." "Trade-only, no withdraw" is the number-one rule: quant never needs withdrawal at any point, so turn it off and a leaked key still can't move your money. The "IP allowlist" locks the key to the one IP your script runs on. "Beware managed-account scams" is a different class of risk — not a technical hole, but someone directly tricking you into handing over a full-permission key, and the losses from that class are often the worst. Skip any one of these and the risk level is completely different.
The rest narrow the exposure further: isolate funds in a sub-account, store the trio of credentials properly and keep them out of the code, rotate and delete old keys regularly, and turn on 2FA and an anti-phishing code at the account level. Ticking all of them only means you've reached the basic security floor — not absolute safety; but missing any one is a real opening. This tool doesn't collect your ticks — it counts purely in your browser and resets to zero when you close the page.
Get your account and sub-account ready, create the key with least privilege, verify the flow on the demo, then cold-start with a tiny bit of real money. New accounts that sign up for OKX with the referral code get a fee discount — and orders placed via the API get it too.
Crypto asset prices swing violently, and derivatives and leverage can wipe out your entire principal. Quant and automated trading don't guarantee profit, this checklist is for reference only, so only use funds you can afford to lose.
