Bitget vs OKX API

Bitget 40

Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.

OKX API 65

Read with the hosted lines on the V5 REST API. okx.com/status is OKX's own page with issue descriptions, maintenance notices and deposit and withdrawal status, but no component history or feed (10 of 20). It lists no incident between 5 August and 3 November 2026; its newest entry is from March 2024, and whether every incident reaches the page cannot be told, so read as clean with a doubt (20 of 30). Rate limits per endpoint, per User ID and per sub-account with numbers, and WebSocket limits (15). Error 50011 on a limit, a clOrdId on orders and a cap of 3 amendments in flight, but no Retry-After or backoff guidance found (10 of 15). No SLA (0). Generally available (10). 10 + 20 + 15 + 10 + 0 + 10 = 65.

Bitget 40

No machine payment protocol (0). Base spot and futures rates are stated in a help article without login, the tier table draws by script (20). Market data needs no key, demo trading costs nothing and no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 40.

OKX API 20

No machine payment protocol (0). The fee table loads by script and the fee FAQ defers to the logged-in view, so no rate was read (0 of 20, unchecked). Public market data and demo trading need no funded account or card (20). A person signs up, verifies and mints a key (0). 0 + 0 + 20 + 0 = 20.

Bitget 83

Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, dryRun: true on every write, confirm: true gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.

OKX API 77

limit parameters on books, candles and history, and in the kit --modules and --read-only narrow 170 tools to the three default modules; no field selection (17 of 25). after, before and limit cursors on history endpoints (18 of 20). Numeric codes with messages, such as 51020 for an invalid quantity, and the kit returns a structured error block with code, message and endpoint (17 of 20). clOrdId on orders, batch endpoints and a cap of 3 amendments in flight; the kit sets readOnlyHint on query tools but destructiveHint false on order tools and has no idempotency key (13 of 20). python-okx, the CLI and a demo profile, with passphrase and HMAC signing on every private call (12 of 15). 17 + 18 + 17 + 13 + 12 = 77.

Bitget 62

API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need confirm: true (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.

OKX API 68

Key, secret and passphrase with Read, Trade and Withdraw permissions, up to 20 bound IPs, revocation in the account, and unbound Trade or Withdraw keys that expire after 14 idle days; no OAuth (28 of 30). Read-only keys, sub-account keys, demo trading, the kit's --read-only flag and its startup check that hides order tools when the key cannot trade, and an API Agreement requiring minimum scope; no confirmation step in the kit (18 of 20). The news and smartmoney modules return third-party text and the docs read give no guidance on treating it as untrusted (5 of 15). An account audit log tool in the kit and usage records for unbound keys in the Security Center, no per-call log (9 of 15). No security.txt; SECURITY.md with security@okx.com and GitHub private advisories; certifications and a bounty not read (8 of 20). 28 + 18 + 5 + 9 + 8 = 68.