Authentication across broker APIs
24 of 29 records carry this field. 3 of those are labelled unverified, and 5 have nothing recorded.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
What this is
Authentication is how an API knows a request is yours. The common patterns are a long lived key or token sent with every request, a login call that returns a session token which expires, and OAuth, where you approve an application on the provider's own site.
The pattern decides how much work a long running program has to do. A session that expires needs code to keep it alive or to log in again. A token that never expires needs more care in how it is stored.
Each entry below is the record's own wording. The entries are in order of name. The order is not a ranking and nothing here recommends a broker.
Brokers
- Bitget
Signed requests. Every REST request carries the headers ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP and ACCESS-PASSPHRASE. The signature is the timestamp, the upper case method, the request path, the query string and the body joined together, signed with HMAC SHA256 using the secret key (or with an RSA private key) and then Base64 encoded. For REST the page gives the timestamp in milliseconds since the epoch, and its sample code computes it that way. The WebSocket login is signed in a similar way, but Bitget's page is not consistent about its timestamp unit, so this record states none for it; the login message page sets out both readings.
- Capital.com
POST /session with the X-CAP-API-KEY header plus login credentials returns CST and X-SECURITY-TOKEN, sent on later calls. The session expires after 10 minutes of inactivity.
Capital.com Public APIchecked
- Deriv
Two routes: an OAuth 2.0 app, or a Personal Access Token the user generates and pastes into the app. Either way the token is sent as a bearer token. With a Personal Access Token, REST requests also need a Deriv-App-ID header.
Deriv API: authenticationchecked
- Dukascopy
JForex API: the client connects with the platform's connection address, a username and a password. In live mode a connection from an IP address that is not registered also has to answer a captcha image for a PIN. FIX API: a Logon message carrying the username and password issued by Dukascopy, over an SSL encrypted TCP socket, from an agreed IP address.
Dukascopy wiki, JForex SDK LIVE modechecked Dukascopy FIX API Programming Guide, revision 8.8.1checked
- eToro
Headers x-api-key, x-user-key and x-request-id on every request, or an OAuth 2.0 bearer token instead of the key headers. eToro now states the exclusivity itself rather than leaving it to be inferred: a request presenting both is rejected.
eToro API portal: authenticationchecked SSO and OAuth, eToro API portalchecked
- Exness
An API Key plus a Secret Key.
- FOREX.com / StoneX Trading (City Index)
A session token. POST your user name, password and the AppKey you were issued to /v2/Session, then send the returned session token and your user name with every request as the request headers Session and UserName. Passing them in the query string is marked obsolete. The documentation says a token is valid for at least 20 minutes, and an expired one is signalled by HTTP 401. Subscribing to the streams uses the user name and the session token as its credentials.
StoneX API documentation, API basicschecked StoneX API documentation, LogOn v2checked
- FXCM
FIX, the Java API and ForexConnect only. No REST API is listed on FXCM's current API pages, so the legacy REST token flow this site described is recorded as no longer listed rather than retired.
FXCM Socket REST API specchecked
- IG
API key plus username and password returns CST and X-SECURITY-TOKEN, valid 12 hours on a rolling basis with each call resetting the clock on the IG Labs FAQ, while IG's REST trading API guide says 6 hours at first, extended up to a maximum of 72 hours: a disagreement between two IG pages that the blocked reference page could not settle on 23 Sep 2026. The v3 OAuth access token lasts as long as the login response says, with a refresh token that expires later. All tokens are invalidated during weekend maintenance.
Sources conflict IG Labs FAQ: 12 hours between calls, reset by each call. IG Labs REST trading API guide: 6 hours at first, extended up to 72 hours while in use.
IG Labs REST trading API guidechecked IG Labs FAQchecked
- Interactive Brokers
TWS API: local socket to a TWS or IB Gateway the user has logged in to by hand. Web API: Client Portal Gateway with a browser login on the same machine; the Web API also lists OAuth 1.0a, OAuth 2.0 and SSO, and IBKR's older use cases page gives OAuth as the route for institutional clients.
IBKR TWS API documentation, the IB Gatewaychecked IBKR Web API documentation, limitations of the Client Portal Gatewaychecked IBKR Web API v1.0 documentation, introductionchecked Client Portal API documentation, use cases (IBKR GitHub pages)checked
- OANDA
Bearer personal access token, generated in the Account Management Portal after accepting the API licence.
- Pepperstone
Unverified beyond one phrase. Pepperstone's API trading page, re-read 12 Oct 2026, says only that the Standard API uses an API key generated after approval. It names no header, signature or token lifetime, and nothing at all for the FIX route.
UnverifiedPepperstone API tradingchecked
- Saxo OpenAPI
OAuth 2.0 authorization code (with or without PKCE); app key and secret for live. Refresh tokens rotate: each is invalidated on use and replaced. Certificate-based auth is for select partners only, not retail.
Saxo OpenAPI Learnchecked
- Swissquote
Unverified. The pages opened on 12 Oct 2026 do not describe how a session is authenticated. The FIX specifications are PDF files on library.swissquote.com, whose robots.txt disallows automated reading, so they were not opened, and the REST specification page did not render its content without scripts.
UnverifiedSwissquote institutional Forex APIschecked
- Trading 212
HTTP Basic: Authorization header of Basic base64(API_KEY:API_SECRET).
- XTB
Not applicable. XTB's help centre states that API access is no longer available and that the service was discontinued on 14 March 2025, so there is no authentication route left to document. Last looked for 9 Oct 2026.
XTB help centre: Does XTB offer investment automation tools?checked
Platform APIs
- cTrader Open API
OAuth 2.0 authorisation code flow: the auth code lives 1 minute, the access token 30 days. Scopes are accounts, which is read only, and trading, which is full.
Account authenticationchecked
- DXtrade APIs
Unverified. The DXtrade developer portal at demo.dx.trade/developers returned only a page title without scripts on 12 Oct 2026, as it did in September, so the authentication scheme could not be read. Devexperts' APIs page links to that portal and states nothing itself.
UnverifiedDXtrade developer portal (content did not render)checked
- Match-Trader Platform API
POST email, password and brokerId to /manager/co-login, or manager/login/co/with-token for a one time token. The co-auth cookie has Max-Age 3600 seconds and the refresh cookie rt has Max-Age 31536000 seconds, Secure and HttpOnly; refresh at manager/refresh-token with no body. Trading calls need the Auth-trading-api header taken from tradingAccounts plus the co-auth cookie.
- MetaApi
An authorisation token sent in the auth-token header of every REST request. You take the token from the MetaApi web application. An invalid token returns HTTP 401.
MetaApi documentation, authentication and authorisationchecked
- MetaCopier
API keys, of two kinds. A project level key, created under Projects then API Keys, reaches every account in the project. An account key is generated automatically when an account is created and reaches only that account. A key can carry an access policy that restricts endpoints, hides account fields and limits the IP addresses and origins it works from. The Socket API takes the same key in an api-key header on the STOMP CONNECT frame.
MetaCopier documentation, REST APIchecked MetaCopier documentation, access policychecked MetaCopier documentation, Socket APIchecked
- MetaTrader 4 (MQL4)
No API keys: code runs inside a terminal already logged in to a trading account.
MQL4 Referencechecked
- MetaTrader 5 (Python package and MQL5)
No API keys: initialize() connects to the local terminal, optionally with account login, password and server.
initializechecked
- TradeLocker API
POST email, password and server to /auth/jwt/token; send the JWT as Bearer token; refresh tokens issued. /trade/* routes also need the accNum header (not the accountId).
Not recorded
These records hold nothing for this field yet. That is a gap in this dataset. It says nothing either way about the broker or platform.
- Axi: not recorded
- CMC Markets: not recorded
- FxPro: not recorded
- ThinkMarkets: not recorded
- Tickmill: not recorded