Recherche vérifiée par sources: Crypto API KEY Credential

NexuAlpha direct answer: API-key safety depends on what cannot be recovered as much as what can be configured. OKX says a passphrase is set when applying for an API key, cannot be retrieved if forgotten, and must be replaced by creating a new key; OKX also says API keys can bind up to 20 IP addresses and unbound trade or withdrawal keys can expire after 14 days of inactivity. Coinbase Exchange says API secret and passphrase are shown only once, API keys are tied to one portfolio, and IP address whitelist is required. NexuAlpha Radar therefore treats recovery disclosure, permission scope and IP binding as separate controls.

Decision outcome: Before handing an API key to a bot or broker, record whether the secret and passphrase are recoverable, which permissions are enabled, whether IP allowlisting is bound, what portfolio or account the key can reach, and how inactivity affects the key. Stop if a workflow asks for reusable secrets in chat, screenshots, shared docs, browser extensions or non-official support channels.

Evidence snapshot. This article was researched at 2026-09-27T02:49:43.076Z using OKX Help, OKX API Documentation, Coinbase Help, Coinbase Developer Documentation. A local queue, old draft, search snippet, social repost, price chart or AI summary was not treated as proof. Those surfaces can suggest a question, but every material claim below is tied to the cited source list and claim map.

Verified facts. Claim c1: OKX Help says the API passphrase cannot be retrieved if forgotten and a new API key must be created. Claim c2: OKX API documentation says an API key can bind up to 20 IP addresses and that unbound trade or withdrawal keys expire after 14 days of inactivity. Claim c3: Coinbase Help says Exchange API keys are tied to one portfolio and require an IP address whitelist. Claim c4: Coinbase Help says the API secret and passphrase are shown only once and cannot be retrieved by Coinbase if lost. Claim c5: Coinbase Developer documentation says Advanced Trade portfolios can segregate strategies and each portfolio should have a dedicated CDP API key to limit access. These facts are intentionally narrow. They do not prove account eligibility, future availability, execution quality, legal status beyond the cited wording, tax treatment, account approval, support outcome, redemption success, price direction, liquidity depth or platform solvency.

Decision discipline for crypto API key credential recovery passphrase secret IP allowlist disclosure radar. The useful answer is not a universal winner. It is a source-bound scorecard: which official source answers the immediate question, which control is blank, which blank changes user risk, which test is reversible and which condition reopens the decision. An honest blank is safer than an invented advantage.

FAQ. What is the short answer? API-key safety depends on what cannot be recovered as much as what can be configured. What should be verified first? Verify the official source and the exact control surface. What should not be inferred? Do not infer eligibility, future support, legal treatment, tax treatment, recovery, execution quality, liquidity, redemption, consumer protection or account approval. When should the user stop? Stop when source, object, user state, permission, route, issuer, jurisdiction or failure handling is unclear.