Connecting OKX to a Tracker Without Losing Half the Balance

You connect OKX, the balance loads, and it is short. Not by a rounding error. Short by exactly the amount you deposited last month and never moved anywhere.

That is almost never a broken connection. It is OKX's account model doing what it was designed to do, and once you know the shape of it the fix takes a minute.

Why does OKX show two balances for the same coin?

Because OKX runs two account containers side by side, and your USDT can be in either.

The Funding account is where deposits land, where P2P purchases settle, and where money waits before you do anything with it. The Trading account is where spot, margin and derivatives balances live, and it is what fills after a trade executes. Same coin, same exchange, two different pockets, and OKX will happily let you sit with a balance split across both for months without ever mentioning it.

Any tool reading your account has to ask about both. If a tracker only queries the trading balance, everything you deposited and left alone is invisible, and the total it reports is honestly, precisely wrong. This is the single most common OKX support ticket in every portfolio app, and it is the first thing to check before you assume the key is faulty. Why your portfolio balance is wrong covers the same failure mode across other venues.

There is a third place assets go. Positions in OKX Earn, covering flexible savings, on-chain staking, dual investment and structured products, sit outside both containers, and the balance endpoints do not report them as spot holdings. Anything locked in Earn generally needs to be entered by hand if you want it in the total. Tracking staked and locked assets explains how to record those without corrupting your cost basis.

One more wrinkle worth knowing before you start: OKX's account can run in different trading modes, from simple spot through to portfolio margin. Switching modes changes how positions are represented internally, which occasionally changes what a tracker reads back. If your figures shift the same week you changed account mode, that is the cause.

How do I create a read-only API key on OKX?

The control lives in different places on web and mobile, which is worth stating plainly because the two paths look nothing alike.

On the website, open your Profile menu and choose API and connections, then Create API key. In the OKX app, tap the menu icon, scroll to API, and tap Create API key. Either way you land on the same form.

1. Name the key after the app you are connecting. In six months you will want to know which one to revoke.
2. Pick the account. The dropdown offers your master account and any sub-accounts. A key issued to the master does not read the sub-accounts, so choose deliberately.
3. Set the purpose. OKX asks what the key is for, separating personal use from binding a third-party application. Read-only tracking is a third-party binding.
4. Enter the IP allowlist. OKX accepts up to twenty addresses, comma or space separated. Enter the addresses your tracker publishes, not your own — the requests come from the tracker's servers, never your handset.
5. Tick Read. Nothing else. OKX offers Read, Trade and Withdraw, and depending on what your account has enabled it may also offer Transfer, Loan and Earn. Read is the only one a portfolio tracker uses. Trade and Withdraw stay off. Transfer stays off too, even though it only moves money between your own accounts.
6. Set a passphrase, then copy the key, the secret and the passphrase before you close the page.

The permission list is enforced by OKX, not by the app you paste the key into. A request to sell something, signed with a key that carries no Trade permission, is rejected at OKX's servers. Trading and withdrawal permissions stay off, and with them off the key is read-only by construction: it can answer questions about your account and it cannot move funds, no matter who is holding it. That is why read-only access is safe in a way that a promise from an app never would be, and read-only API keys sets out the mechanics in full.

Why does OKX ask for a passphrase, and what happens if I lose it?

Most exchanges hand you two strings. OKX hands you three.

The passphrase is one you invent at creation, and it is folded into the signature on every authenticated request. A tracker holding your key and secret but not your passphrase cannot authenticate at all. It is not your account password, not your fund password, and not your 2FA code, though people conflate all four constantly.

OKX will not show it to you again. You can go back later and edit a key's name, its permissions and its IP list, but the passphrase is not editable and not recoverable. If you cannot remember it, the only route forward is to delete the key and generate a replacement. Treat it exactly as you treat the secret: stored somewhere encrypted, never in a chat message, never in a screenshot.

What does OKX do about key expiry and IP restriction?

OKX ties the two together in a way that quietly rewards the cautious setup.

A key that carries transaction or withdrawal permission and has no IP binding gets deactivated after fourteen days without use. A read-only key bound to an IP address does not expire on that clock. The published rules are set out in OKX's own API FAQ, and the practical reading is simple: the narrowest, most restricted key you can issue is also the one least likely to go stale on you six months from now.

Allowlisting matters for a second reason. A read-only key that leaks is a privacy problem rather than a custody problem, because it still cannot place an order or move a coin. Bind it to the tracker's addresses and even that privacy exposure closes, because OKX refuses requests arriving from anywhere else. Is it safe to connect an exchange works through what the residual exposure actually is.

What will not come across from OKX?

Four things, and none of them indicate a fault.

Sub-account holdings need their own keys, as above. Earn positions need manual entry. Anything in the OKX Web3 Wallet is outside the exchange entirely. It is self-custody, secured by a recovery phrase you hold, and no exchange API key can see it. Track those balances by adding the public addresses as watched wallets, which is the same approach covered in tracking one identity across several chains.

The fourth is trade history depth. OKX limits how far back the API will return fills, so a tracker connecting today reconstructs recent activity rather than your entire history. If you need years of cost basis, export it from OKX directly and add the older positions manually.

Once the key is in and both account containers are reporting, the OKX number stops being something you verify and starts being something you glance at. The right time to check it again is the next time you move funds between Funding and Trading, because that is the one action on OKX that can make a correct total look broken.