Start with the error code and request time. Keep credentials out of bug reports. If an order request timed out, look up its client order ID before submitting a replacement: the exchange may already have accepted it.
Use the error to choose the next check
| Error | First check | A useful confirmation |
|---|---|---|
| 50101: environment mismatch | Demo key paired with x-simulated-trading: 1 | A demo balance request succeeds |
| 50102: expired timestamp | UTC clock, synchronization and request delay | Regenerate both timestamp and signature after syncing |
| 50113: invalid signature | Secret and the exact signed request bytes | Sign and send the same method, path and body |
Do not remove the demo header as a random fix. Decide which environment you intend to use, then keep its key and request configuration together.
The clock can look right and still be wrong
A correct time-zone setting does not guarantee an accurate system clock. Compare the public /api/v5/public/time response with your clock, allowing for network round-trip time. Generate a fresh timestamp close to sending each request; a timestamp cached when the program started will expire. Changing it also requires a new signature.
Sign the request you actually send
For REST requests, concatenate the timestamp, uppercase method, request path and body. Apply HMAC-SHA256 with the Secret, then Base64-encode the result. GET query parameters belong in the signed path; a request without a body does not append the text null.
GET: /api/v5/account/balance?ccy=USDT
POST: /api/v5/trade/orderSerialize a JSON body once. Use that same string for signing and transmission. Signing one string and asking a client library to serialize a different object afterward can change spacing, field order or numeric strings.
A successful HTTP response is not a filled order
Check the top-level code, then the per-order sCode and sMsg. Order acceptance, resting, partial fill, fill and cancellation are separate states. After authentication works, size or account-mode errors require a different diagnosis; repeatedly replacing your API key will not fix them.
Share a useful, redacted bug report
Include the method, path, UTC timestamp, error code, SDK version and relevant order parameters. Remove keys, secrets, passphrases, signatures and balances. Never upload an entire environment file. For credential setup, return to the OKX API key guide.
