dYdX vs OKX API

dYdX 60

No machine payment protocol (0). Fees public per tier without login (20). Testnet with a faucet and no card anywhere (20). No signup; an agent with a funded wallet trades, subject to the geographic terms (20). Total 60.

OKX API 20

No machine payment protocol (0). The fee table loads by script and the fee FAQ defers to the logged-in view, so no rate was read (0 of 20, unchecked). Public market data and demo trading need no funded account or card (20). A person signs up, verifies and mints a key (0). 0 + 0 + 20 + 0 = 20.

dYdX 83

Read with the hosted lines on the indexer API and the chain endpoints the clients submit to. status.dydx.trade is an Atlassian Statuspage with Frontends, dYdX Chain, Indexer, Order Gateway and Client Libraries components and an RSS history (20). From 1 August to 3 November 2026 the feed has eight items, seven scheduled maintenance windows of 29 minutes to 2 hours (indexer on 9 September, 8 and 15 October, protocol v9.7 on 11 September and v9.8.0 on 12 October, WebSocket compression on 26 and 28 October) and one degraded instant-deposit path through an onboarding partner from 24 to 29 September, outside the trading API. Clean or trivial (30). Rate limits documented with numbers for the indexer, the block limits and the public nodes (15). No 429 shape or Retry-After for the indexer; short-term orders expire by goodTilBlock and client IDs let an agent find an order after a timeout (8 of 15). No SLA (0). Mainnet generally available; the Order Entry Gateway is marked testnet-only (10). 20 + 30 + 15 + 8 + 0 + 10 = 83.

OKX API 65

Read with the hosted lines on the V5 REST API. okx.com/status is OKX's own page with issue descriptions, maintenance notices and deposit and withdrawal status, but no component history or feed (10 of 20). It lists no incident between 5 August and 3 November 2026; its newest entry is from March 2024, and whether every incident reaches the page cannot be told, so read as clean with a doubt (20 of 30). Rate limits per endpoint, per User ID and per sub-account with numbers, and WebSocket limits (15). Error 50011 on a limit, a clOrdId on orders and a cap of 3 amendments in flight, but no Retry-After or backoff guidance found (10 of 15). No SLA (0). Generally available (10). 10 + 20 + 15 + 10 + 0 + 10 = 65.

dYdX 58

No OpenAPI file found for the indexer; the docs publish a types reference of about 200 pages (OrderSide, TimeInForce, OrderStatus and the rest) and the chain's protobuf messages are in the clients (8 of 25). llms.txt and Markdown docs (10). Endpoint pages describe each call and the guides say when to use short-term against long-term orders and the indexer against the node, but descriptions are short (12 of 20). Enums and types on every field in the reference, with pagination and cursor parameters typed (11 of 15). Examples in Python, TypeScript and Rust for each step; errors are described by HTTP status (400 malformed, 404 not found) with no code list (9 of 15). A /v4 path, protocol releases dated on the status page, deprecated rate-limit fields marked, but no API changelog (8 of 15). Total 58.

OKX API 73

No OpenAPI file was found in the V5 docs; the kit's tool definitions are typed TypeScript with annotations, and the organisation has an undescribed ai-builder-openapi-md repository we did not read (12 of 25). okx.com/llms.txt exists and links the API and Agent Trade Kit pages, though the V5 docs have no Markdown twins (5 of 10). Each endpoint states its rate limit, rule, parameters and notes (15 of 20). Enums for ordType, tdMode and instType with required flags (12 of 15). Request and response examples per endpoint and an error code list with messages (14 of 15). A dated changelog with an upcoming-changes section that labels breaking changes and dates sunsets (15). 12 + 5 + 15 + 12 + 14 + 15 = 73.

dYdX 50

The editorial half. Clients AGPL-3.0 with a terms-bound use condition, the chain under a custom licence, two terms documents (dYdX Trading Inc.'s v4 terms of 12 March 2026 and dYdX International Ltd's of 6 June 2025) that are clear about who runs nothing (22 of 30). The privacy policy of 6 June 2025 names dYdX International Ltd, keeps technical data until no longer necessary with no periods, and names no subprocessors; nothing covers the unnamed indexer operator (12 of 30). Protocol upgrades and the WebSocket compression change were posted as dated maintenance notices, deprecated rate-limit fields are marked, but no deprecation policy or notice period is stated (10 of 20). The policy says data may be processed in the EEA and elsewhere, with no subprocessor list (6 of 20). Total 50.

OKX API 62

The editorial half. A closed service with terms that name the contracting entities by region and an API Agreement for agents; the kit is MIT (17 of 30). The privacy policy was not read (5 of 30). The changelog dates sunsets and labels breaking changes, such as port 8443 on 31 October and 16 November 2026 (16 of 20). No subprocessor or data-location statement read; the MCP server is local and its npm package runs a postinstall script whose purpose we did not trace (0 of 20). 17 + 5 + 16 + 0 = 38.

dYdX 66

An API, read for response sizing. limit on list endpoints, candles by resolution, sparklines by period; the order book comes whole (16 of 25). limit, page on fills, transfers and funding, and height or time cursors (16 of 20). Indexer errors are a status and a sentence; order rejections come back from the chain as transaction results the clients surface (8 of 20). Unique 32-bit client IDs, goodTilBlock expiry on short-term orders, cancel by order ID; no MCP annotations apply (14 of 20). Few required fields with market parameters fetched for unit conversion, and official clients in TypeScript, Python and Rust (12 of 15). Total 66.

OKX API 77

limit parameters on books, candles and history, and in the kit --modules and --read-only narrow 170 tools to the three default modules; no field selection (17 of 25). after, before and limit cursors on history endpoints (18 of 20). Numeric codes with messages, such as 51020 for an invalid quantity, and the kit returns a structured error block with code, message and endpoint (17 of 20). clOrdId on orders, batch endpoints and a cap of 3 amendments in flight; the kit sets readOnlyHint on query tools but destructiveHint false on order tools and has no idempotency key (13 of 20). python-okx, the CLI and a demo profile, with passphrase and HMAC signing on every private call (12 of 15). 17 + 18 + 17 + 13 + 12 = 77.

dYdX 78

Orders are signed by the account key or by a permissioned key the owner adds as an authenticator, limited by message type, subaccount and market with AllOf or AnyOf, and revoked by remove_authenticator; no shared secret and nothing in a URL (28 of 30). A key can be confined to placing and cancelling orders on one subaccount with withdrawals and transfers excluded, though not to a position or order size, and the interface's default API wallet trades all cross-margin pairs (16 of 20). The API returns no untrusted content (10). Every action is a chain transaction and the indexer lists fills, orders and transfers per subaccount, and authenticators can be listed; no per-key log (10 of 15). A Cantina bug bounty up to $1,000,000 sponsored by dYdX Trading Inc. over the protocol, indexer, web client and SDKs, an Informal Systems audit; no security.txt and no certification (14 of 20). Total 78.

OKX API 68

Key, secret and passphrase with Read, Trade and Withdraw permissions, up to 20 bound IPs, revocation in the account, and unbound Trade or Withdraw keys that expire after 14 idle days; no OAuth (28 of 30). Read-only keys, sub-account keys, demo trading, the kit's --read-only flag and its startup check that hides order tools when the key cannot trade, and an API Agreement requiring minimum scope; no confirmation step in the kit (18 of 20). The news and smartmoney modules return third-party text and the docs read give no guidance on treating it as untrusted (5 of 15). An account audit log tool in the kit and usage records for unbound keys in the Security Center, no per-call log (9 of 15). No security.txt; SECURITY.md with security@okx.com and GitHub private advisories; certifications and a bounty not read (8 of 20). 28 + 18 + 5 + 9 + 8 = 68.