Coinbase 与 OKX API Key 权限及 IP 白名单控制对照

决策矩阵

来源地图

• Coinbase Help：How to create an API key（s1）
• OKX：OKX API Agreement（s2）
• OKX：OKX API Guide（s3）
• Coinbase Help：Is my API key secure?（s4）
• CISA：Securing APIs（s5）

控制说明

1. Permission model

这一项要求读者先把公开来源翻译成操作规则。这里的含义是：Coinbase names product permissions while OKX frames minimum scope as a user obligation。可执行动作是：map each integration action to the narrowest possible permission。仍然未知的是：whether a third-party bot requests broader access than the documented need。因此本文不会把未知部分包装成安全承诺、收益承诺、官方背书、审批保证、可用性保证或注册诱导。

2. IP binding

这里的含义是：Coinbase requires an IP whitelist field and OKX requires IP allowlisting where available。可执行动作是：avoid creating trade or transfer keys for unknown or shifting infrastructure。仍然未知的是：whether the user's hosting environment has stable outbound IPs。

3. Secret recovery

这里的含义是：Coinbase says lost API secrets and passphrases cannot be retrieved。可执行动作是：store secrets in a manager and rotate instead of asking support to recover them。仍然未知的是：whether existing old keys were copied into logs or code repositories。

4. AI-agent risk

这里的含义是：OKX explicitly names authorized AI agents and unexpected behavior reporting。可执行动作是：add kill switches, logging and scope review before allowing automated order placement。仍然未知的是：whether future venue terms add new AI-agent obligations。

5. Audit outcome

这里的含义是：the comparison should produce a key inventory, not a venue ranking。可执行动作是：list key owner, permission, IP range, rotation date and disabled status。仍然未知的是：the private state of any existing key。

仍需明确的未知项

• whether a third-party bot requests broader access than the documented need
• whether the user's hosting environment has stable outbound IPs
• whether existing old keys were copied into logs or code repositories
• whether future venue terms add new AI-agent obligations
• the private state of any existing key

实用结论

本文最有价值的地方是克制。Coinbase 与 OKX 都把 API key 权限视为安全决策，但控制方式并不相同。Coinbase Exchange 在创建 API key 时要求填写 IP 白名单，并区分 View、Transfer、Trade、Manage 权限；OKX API 协议强调最小权限、MFA、可用时启用 IP 白名单、加密存储以及疑似泄露后的轮换。 用户应获得一个更清楚的核验路径，而不是一个看似肯定、实则无法由公开证据承担的承诺。