Your safety first

Security

Understand the custody model, credential permissions and remaining risks before connecting an account.

💡

Prefer watching over reading? Below you'll find a short video that covers the same information as this page. Feel free to read the text, watch the video — or both!

🎬 Video

Watch: Security of A-DCA explained

This video explains trade-only API permissions, encrypted credential storage and the custody model. Verify current provider settings and review the remaining risks described on this page.

🛡️

A-DCA does not take custody of your funds

A-DCA requests trading permissions for OKX integration, not withdrawal permission. Assets remain in your exchange account, while exchange, credential and trading risks still apply.

What A-DCA can and cannot do

This is controlled by the OKX API key settings — not by us.

✅ What we CAN do

  • ✓ View your account balance
  • ✓ Place buy orders for Bitcoin
  • ✓ Place sell orders for Bitcoin
  • ✓ View your trade history
  • ✓ Monitor market prices

🚫 What we CANNOT do

  • ✕ Withdraw your funds
  • ✕ Transfer to other wallets
  • ✕ Change your account settings
  • ✕ Access your personal data
  • ✕ See your OKX password

How we protect you

🔐

Trading-only API

When you create an API key on OKX, you choose its permissions. A-DCA requires 'Trade', not 'Withdraw'. This reduces direct withdrawal exposure, but a compromised trading key could still be used for harmful trades.

🚫

Withdrawal permission not requested

The withdrawal permission is never requested and never granted. This is enforced at the OKX level — not just our promise.

🔑

Encrypted storage

API credentials are encrypted at rest by the configured AES-256 service and decrypted by the trading runtime when needed. Encryption reduces exposure but does not eliminate server, secret-management or operator risk.

🛡️

Your funds on OKX

A-DCA does not receive custody of the trading deposit. Bitcoin and USDT remain in the connected OKX account and are subject to OKX counterparty, account, policy and security risks.

How the connection works

A simple diagram of how A-DCA connects to your OKX account:

🏦
Your OKX Account
Your Bitcoin and USDT stay in the connected account. You control exchange access, while OKX and market risks remain.
Your funds
↕️
🔑
API Key (Trade Only)
You create this on OKX with trade permission and without withdrawal permission. A-DCA stores it encrypted, but compromise can still enable harmful trades.
Encrypted
↕️
🤖
A-DCA Robot
Analyzes market, places buy/sell orders. Cannot withdraw. Cannot access your personal data.
Trade only
🟣 Hyperliquid Security

Hyperliquid: Reduce centralized custody exposure

Hyperliquid offers a non-custodial account model in which assets are associated with your wallet. The API wallet is configured for trading, while wallet, smart-contract and network risks remain.

🏦

OKX (CEX Model)

🏦 Funds on exchange
🔐 API with withdrawal disabled
🛡️ Exchange security + insurance
✅ Safe & regulated
🟣

Hyperliquid (DEX Model)

👛 Funds on YOUR wallet
🔐 API wallet cannot withdraw
🔏 Hardware wallet support
✅ Maximum self-custody
🚧

API/Trading Wallet Separation

Hyperliquid uses a separate trading agent. It is not intended for withdrawal, but it can place orders and compromise can still create trading losses.

🔏

Hardware Wallet

A compatible hardware wallet can keep the main signing key on the device. Phishing, malicious approvals, device compromise and trading-agent risks still apply.

⛓️

Non-Custodial DEX

Hyperliquid reduces reliance on a centralized exchange balance, while protocol, wallet and infrastructure risks still apply.

✅ A trading API wallet is not intended to withdraw USDC or BTC, but compromise can still cause losses through unauthorized or adverse trades.

Setting up securely

1

Create API key on OKX

In OKX settings, create a new API key. Select only 'Trade' permission. Do NOT select 'Withdraw'.

2

Add to A-DCA

Paste the API key and secret into A-DCA only after checking permissions. They are encrypted at rest, while operational and credential risks remain.

3

Robot starts trading

A-DCA uses the API key to place trades on your behalf while assets remain in the connected OKX account.

4

You stay in control

You can revoke the API key on OKX at any time. This immediately stops A-DCA from trading.

🎬 Video walkthrough

Watch these videos to see exactly how to create your OKX API key and register in A-DCA — the two steps described above.

🎬 Video

Watch: How to create API keys on OKX

Step-by-step video: open the API menu on OKX, fill in the fields, and save your trading key securely.

🎬 Video

Watch: Register & sign in to A-DCA

Full walkthrough of the A-DCA registration and sign-in process — from the form to your first successful login.

OKX REST API Integration

A-DCA uses standard OKX REST API v5 endpoints. No special permissions required beyond 'Trade'.

GET /api/v5/market/candlesOKX Docs ↗

Get candlestick (OHLCV) data for the trading pair. Used to read current price and calculate technical indicators (RSI, CCI, Bollinger Bands).

POST /api/v5/trade/orderOKX Docs ↗

Place a new market order (BUY or SELL). Used by the DCA algorithm to execute trades and by the risk management system to close positions.

GET /api/v5/trade/orderOKX Docs ↗

Get details of a specific order by order ID. Used after placing an order to retrieve the actual fill price, amount, and commission.

GET /api/v5/account/balanceOKX Docs ↗

Get account balance. Used to check available USDT and BTC balances before placing orders.

🔒 All API calls use 'Trade' permission only — withdrawal permission is never required.

Start with verified permissions

Review the account permissions, revoke procedure and trading risk disclosure before starting the free month.

🚀 Start Free Trial