Bybit vs OKX API

Bybit 45

Graded with the hosted lines on the V5 API at api.bybit.com. No status page found (status.bybit.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint and per UID with numbers, plus a 600 per 5 second IP limit (15). Every response carries X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 and HTTP 403 are documented with a wait rule, and orders take a unique orderLinkId that amend and cancel accept (15). No SLA (0). V5 is the current production API, not a beta (10). 45.

OKX API 65

Read with the hosted lines on the V5 REST API. okx.com/status is OKX's own page with issue descriptions, maintenance notices and deposit and withdrawal status, but no component history or feed (10 of 20). It lists no incident between 5 August and 3 November 2026; its newest entry is from March 2024, and whether every incident reaches the page cannot be told, so read as clean with a doubt (20 of 30). Rate limits per endpoint, per User ID and per sub-account with numbers, and WebSocket limits (15). Error 50011 on a limit, a clOrdId on orders and a cap of 3 amendments in flight, but no Retry-After or backoff guidance found (10 of 15). No SLA (0). Generally available (10). 10 + 20 + 15 + 10 + 0 + 10 = 65.

Bybit 40

No machine payment protocol (0). The fee schedule is public without login, with VIP 0 maker and taker rates per product and the tier criteria (20). Reading market data needs no key and the demo environment costs nothing, no card is asked for at sign-up (20). A person must register, pass identity verification and mint the key in a browser (0). 40.

OKX API 20

No machine payment protocol (0). The fee table loads by script and the fee FAQ defers to the logged-in view, so no rate was read (0 of 20, unchecked). Public market data and demo trading need no funded account or card (20). A person signs up, verifies and mints a key (0). 0 + 0 + 20 + 0 = 20.

Bybit 66

Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.

OKX API 81

Read as a closed service with an open-source kit. Changelog entry of 27 October 2026 and kit v1.5.0 on 28 October (30). Changelog entries on 3, 6, 11, 18, 20 and 26 August, 15, 29 and 30 September and 27 October, and kit releases on 20 and 21 August, 1, 7, 14 and 23 September, 19 and 28 October (20). A public changelog, a Telegram community for the kit and GitHub issues whose replies were not read (10 of 15). python-okx is named as the official SDK and the kit is current; the MCP server is not in the official registry (12 of 15). The kit runs CI on push and pull request across Node 18, 20 and 26 with unit tests and coverage (9 of 10). 30 + 20 + 10 + 12 + 9 = 81.

Bybit 66

Read for the API with the MCP server beside it. The MCP server has 398 tools in one list with no toolset, module or read-only switch (5 of 25, nothing added back). V5 reads take limit and cursor and category filters (15 of 20). retCode and retMsg on every response with a code list an agent can branch on, though create-order answers before the order is final and the docs say to confirm over WebSocket (14 of 20). orderLinkId makes order retries safe and every MCP tool carries readOnlyHint and destructiveHint (17 of 20). Five required fields on an order, official SDKs in Python, Go, Java and .NET (15). 66.

OKX API 77

limit parameters on books, candles and history, and in the kit --modules and --read-only narrow 170 tools to the three default modules; no field selection (17 of 25). after, before and limit cursors on history endpoints (18 of 20). Numeric codes with messages, such as 51020 for an invalid quantity, and the kit returns a structured error block with code, message and endpoint (17 of 20). clOrdId on orders, batch endpoints and a cap of 3 amendments in flight; the kit sets readOnlyHint on query tools but destructiveHint false on order tools and has no idempotency key (13 of 20). python-okx, the CLI and a demo profile, with passphrase and HMAC signing on every private call (12 of 15). 17 + 18 + 17 + 13 + 12 = 77.

Bybit 51

The editorial half. A closed hosted service. The terms read are the UAE entity's PDF served from bybit.com, clear on API use and availability, but the global terms page renders by script and was not read; the MCP server is MIT (12 of 30). The privacy policy was not read, so data handling is unscored (5 of 30). The changelog dates removals and response changes but gives no notice period or deprecation policy (10 of 20). No subprocessor list or data location statement was read (0 of 20). 27.

OKX API 62

The editorial half. A closed service with terms that name the contracting entities by region and an API Agreement for agents; the kit is MIT (17 of 30). The privacy policy was not read (5 of 30). The changelog dates sunsets and labels breaking changes, such as port 8443 on 31 October and 16 November 2026 (16 of 20). No subprocessor or data-location statement read; the MCP server is local and its npm package runs a postinstall script whose purpose we did not trace (0 of 20). 17 + 5 + 16 + 0 = 38.

Bybit 60

API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.

OKX API 68

Key, secret and passphrase with Read, Trade and Withdraw permissions, up to 20 bound IPs, revocation in the account, and unbound Trade or Withdraw keys that expire after 14 idle days; no OAuth (28 of 30). Read-only keys, sub-account keys, demo trading, the kit's --read-only flag and its startup check that hides order tools when the key cannot trade, and an API Agreement requiring minimum scope; no confirmation step in the kit (18 of 20). The news and smartmoney modules return third-party text and the docs read give no guidance on treating it as untrusted (5 of 15). An account audit log tool in the kit and usage records for unbound keys in the Security Center, no per-call log (9 of 15). No security.txt; SECURITY.md with security@okx.com and GitHub private advisories; certifications and a bounty not read (8 of 20). 28 + 18 + 5 + 9 + 8 = 68.