Skip to content
CoTrading

Learn

Exchange APIs

OKX API error 50111 "Invalid OK-ACCESS-KEY" and its neighbours

CoTrading editorial team

Figures on this page are as of 2026-09. Fees, limits and margin tiers change — check the venue's own docs.

OKX error 50111 comes back with HTTP 401 and the message "Invalid OK-ACCESS-KEY." The value in your OK-ACCESS-KEY header was not accepted as a key — which makes this a question of which key, sent where, not of how you signed the request.

OKX splits authentication failures into a dozen narrow codes, and that is good news: read the code precisely and most of the diagnosis is done. This page puts the whole family in one table, then works through the causes of 50111 specifically — a mangled key string, a deleted or expired key, the demo/live split, and OKX’s regional hosts.

OKX’s authentication codes at a glance

All of these come from OKX’s own V5 error-code table. The “points at” column is our reading of each message.

CodeHTTPOKX’s messagePoints at
50101401“APIKey does not match current environment.”Demo key on live, or the reverse
50102401“Timestamp request expired.”Clock or timezone — more than 30 s off
50104401Request header "OK-ACCESS-PASSPHRASE" cannot be empty.Passphrase header missing
50105401Request header "OK-ACCESS-PASSPHRASE" incorrect.Wrong passphrase
50110401“Your IP {param0} is not included in your API key’s IP whitelist.”Calling from an unbound IP
50111401“Invalid OK-ACCESS-KEY.”The key string itself
50112401“Invalid OK-ACCESS-TIMESTAMP.”Timestamp header malformed
50113401“Invalid signature.”Signature mismatch
50114401“Invalid authorization.”OKX gives no further detail
50115405“Invalid request method.”Wrong HTTP method for the endpoint

Two more belong to the family. OKX’s key-management docs also reference 50119, described as the key not existing, and 50120, the key lacking permission for the function called. The docs do not explain how 50111 and 50119 divide the ground between them; for diagnosis, treat both as “check which key is being sent, and where”.

Note the HTTP column. Every one of these is 401 except 50115, which is 405. A client that branches on the status code alone will misfile that one; read the code field.

Some quick routing before going further:

If it is 50111, read on.

What 50111 actually means

The request reached OKX, and the value in OK-ACCESS-KEY did not correspond to a key OKX would accept for it. That can be a string problem (it is not quite the key), a lifecycle problem (it was the key, and is not any more), or a routing problem (it is a real key, sent to an environment or host that does not know it). Those three are the sections below, in the order worth checking.

The usual cause: the string is not the key

The cheapest thing to rule out, and the most common:

  • Whitespace or a newline from copy-paste, or from reading a file that ends in a newline.
  • Quotes carried over from an .env file into the value.
  • The wrong credential in the slot. OKX has four values — key, secret, passphrase, and the signature you compute — and swapping key and secret, or key and passphrase, is easy when you are used to venues with two.
  • The wrong variable. Two sets of credentials in the environment, and the code picks up the other one.

To check without leaking anything, log the key’s length and its first and last four characters, and compare against the key list in your OKX account. Do not log the secret or the passphrase.

Other causes, in order of likelihood

1. The key was deleted, replaced, or expired

Somebody regenerated the key and one consumer still holds the old one. Or the key expired: OKX expires keys that are not IP-bound and hold trade or withdraw permission after a period of inactivity. The window is stated on OKX’s API key creation page — check it there. Only calls to authenticated endpoints count as use (on WebSocket, only the login), and demo-trading keys do not expire this way.

We did not find it documented which code an expired key returns. If a key that sat idle suddenly fails, check whether it still exists in the key list before debugging anything else. Binding the key to an IP removes the expiry and is recommended anyway; the reasoning is in the exchange API key security checklist.

2. Demo key, live request — or the reverse

OKX’s demo trading uses the same REST host as production; the environment is selected by the header x-simulated-trading: 1. Demo keys are created from the Demo Trading “Personal Center” and belong to that environment only. On WebSocket it is different: demo connects to a separate host, wspap.okx.com, rather than ws.okx.com.

So a demo key sent without the header reaches production, and a live key sent with it reaches demo. OKX has a dedicated code for this, 50101, “APIKey does not match current environment.” Whether a given mix-up comes back as 50101, 50111 or something else in practice is not something the docs state, and we have not confirmed it with a live test. Client-library issue trackers report the demo/live mix-up surfacing as a signature error (50113), which is a third-party observation, not OKX’s documentation.

The practical rule does not depend on which code you get: if you are using demo credentials, confirm the header is actually on the wire — after any proxy, wrapper or retry path that might rebuild the request without it.

3. The wrong regional host

OKX serves some regions from separate domains:

AccountAPI host
Default productionopenapi.okx.com
US and AU users, registered on app.okx.comus.okx.com
EU users, registered on my.okx.comeea.okx.com

For US and AU users, OKX’s docs say openapi.okx.com “will not work”. A key created under one of these accounts and sent to another’s host is likely to reach a system that does not know it. OKX does not document which code results; we would expect an unrecognised-key error, and either way the fix is the host, not the key.

How to confirm which one you have

  1. Read the code exactly. If it is not 50111, go to that row of the table.
  2. Inspect the key value your process actually uses — length, leading and trailing characters, stray whitespace — against the key list in the account.
  3. Check the environment. Is this a demo key? Is x-simulated-trading: 1 present on the outgoing request, or absent for a live key?
  4. Check the host against where the account was registered.
  5. Check the key still exists, and whether it could have expired for inactivity.
  6. If everything matches and 50111 persists, create a new key. If the passphrase is lost, you need a new key anyway — OKX stores only a salted hash and cannot recover it.

50111 is a configuration fault: retrying does not change the answer. Fail loudly and stop, as described in error handling patterns for trading APIs.

FAQ

What does OKX error 50111 mean?

It means OKX did not accept the value in the OK-ACCESS-KEY header, returning HTTP 401 and “Invalid OK-ACCESS-KEY.” The usual causes are a mangled key string, a deleted or expired key, a demo key used against production (or the reverse), or a request sent to the wrong regional host.

What is the difference between OKX errors 50111 and 50113?

50111 means the API key itself was not accepted. 50113, “Invalid signature.”, means the key was accepted but the OK-ACCESS-SIGN value did not match what OKX computed. The first points at credentials and routing; the second at how the request was signed.

Why does my OKX demo API key fail authentication?

Most often because the x-simulated-trading: 1 header is missing, so the demo key reaches production. OKX’s REST API uses one host for both environments and selects demo with that header; OKX documents 50101, “APIKey does not match current environment.”, for this mismatch. On WebSocket, demo uses a separate host, wspap.okx.com.

Can an IP whitelist cause error 50111?

That has its own code. An IP outside the key’s whitelist returns 50110, and the message includes the IP OKX saw, so you can compare it directly to the addresses bound to the key. If you are seeing 50111, look at the key value, environment and host instead.