Gate vs OKX API

Gate 42

Graded with the hosted lines on the API v4 at api.gateio.ws with the hosted MCP beside it. No status page found (status.gate.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint group with numbers and fill-ratio rules (15). Every response carries X-Gate-RateLimit-Limit, X-Gate-RateLimit-Requests-Remain and X-Gate-RateLimit-Reset-Timestamp, 429 answers with the label TOO_FAST, and spot orders take a user text identifier, but no retry or idempotency guidance is written down (12 of 15). No SLA (0). API v4 and the MCP endpoints are production surfaces (10). 42.

OKX API 65

Read with the hosted lines on the V5 REST API. okx.com/status is OKX's own page with issue descriptions, maintenance notices and deposit and withdrawal status, but no component history or feed (10 of 20). It lists no incident between 5 August and 3 November 2026; its newest entry is from March 2024, and whether every incident reaches the page cannot be told, so read as clean with a doubt (20 of 30). Rate limits per endpoint, per User ID and per sub-account with numbers, and WebSocket limits (15). Error 50011 on a limit, a clOrdId on orders and a cap of 3 amendments in flight, but no Retry-After or backoff guidance found (10 of 15). No SLA (0). Generally available (10). 10 + 20 + 15 + 10 + 0 + 10 = 65.

Gate 35

No machine payment protocol (0). The fee page's table loads after login; help centre and learn articles give the VIP 0 spot rates (15 of 20). Market data over REST and the public MCP needs no account and no card (20). A person registers, verifies identity and mints the key or approves the grant in a browser (0). 35.

OKX API 20

No machine payment protocol (0). The fee table loads by script and the fee FAQ defers to the logged-in view, so no rate was read (0 of 20, unchecked). Public market data and demo trading need no funded account or card (20). A person signs up, verifies and mints a key (0). 0 + 0 + 20 + 0 = 20.

Gate 49

The editorial half. A closed hosted service with a clear user agreement that names no company; the MCP packages are MIT (12 of 30). The privacy policy names a DPO address and categories of recipients, with no retention numbers and no named subprocessors (12 of 30). The changelog records breaking changes such as the amend endpoint path move of 16 October 2026 with no notice period or policy (8 of 20). Transfers outside the user's jurisdiction are disclosed with no locations or provider names (5 of 20). 37.

OKX API 62

The editorial half. A closed service with terms that name the contracting entities by region and an API Agreement for agents; the kit is MIT (17 of 30). The privacy policy was not read (5 of 30). The changelog dates sunsets and labels breaking changes, such as port 8443 on 31 October and 16 November 2026 (16 of 20). No subprocessor or data-location statement read; the MCP server is local and its npm package runs a postinstall script whose purpose we did not trace (0 of 20). 17 + 5 + 16 + 0 = 38.

Gate 66

Read for the API with the hosted MCP beside it. The MCP is split by endpoint (58 public tools on /mcp, 400 or more on /mcp/exchange, smaller info and news servers) and the local package filters by module and read-only flag, which stands in for toolsets (5 of 25 for the trading server, 10 added back). Pagination by page and limit, from and to timestamps, status filters (15 of 20). Error labels such as INVALID_SIGNATURE, REQUEST_EXPIRED, IP_FORBIDDEN and READ_ONLY name the recovery (15 of 20). The text order identifier makes retries safe; the local server's source sets no readOnlyHint or destructiveHint and the hosted annotations are unread (8 of 20). Three required fields on a spot order, SDKs in seven languages and a CLI (13 of 15). 66.

OKX API 77

limit parameters on books, candles and history, and in the kit --modules and --read-only narrow 170 tools to the three default modules; no field selection (17 of 25). after, before and limit cursors on history endpoints (18 of 20). Numeric codes with messages, such as 51020 for an invalid quantity, and the kit returns a structured error block with code, message and endpoint (17 of 20). clOrdId on orders, batch endpoints and a cap of 3 amendments in flight; the kit sets readOnlyHint on query tools but destructiveHint false on order tools and has no idempotency key (13 of 20). python-okx, the CLI and a demo profile, with passphrase and HMAC signing on every private call (12 of 15). 17 + 18 + 17 + 13 + 12 = 77.

Gate 60

Gate OAuth 2 for the hosted trading MCP with eight scopes per the protected-resource metadata and revocation on the API management page, and API keys with disabled, read-only or read-write per product group, a separate withdrawal group and an IP allow-list of 20 addresses (30). A read-only key and a GATE_READONLY switch exist, and the guide says fund-moving actions need the person's confirmation in the client, with no server-side cap documented (15 of 20). The news and info servers return third-party content with no guidance on treating it as untrusted (5 of 15). Key changes and OAuth grants are visible on the API management page; no per-call log found (5 of 15). No security.txt, no disclosure policy or bounty on a page we read, a proof-of-reserves repository (5 of 20). 60.

OKX API 68

Key, secret and passphrase with Read, Trade and Withdraw permissions, up to 20 bound IPs, revocation in the account, and unbound Trade or Withdraw keys that expire after 14 idle days; no OAuth (28 of 30). Read-only keys, sub-account keys, demo trading, the kit's --read-only flag and its startup check that hides order tools when the key cannot trade, and an API Agreement requiring minimum scope; no confirmation step in the kit (18 of 20). The news and smartmoney modules return third-party text and the docs read give no guidance on treating it as untrusted (5 of 15). An account audit log tool in the kit and usage records for unbound keys in the Security Center, no per-call log (9 of 15). No security.txt; SECURITY.md with security@okx.com and GitHub private advisories; certifications and a bounty not read (8 of 20). 28 + 18 + 5 + 9 + 8 = 68.