How does each broker API authenticate?
Authentication is how an API knows a request is yours. The common patterns are a key or token sent with every request, a login call that returns a session token which expires, and OAuth.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
Rows are in name order. The order is not a ranking and nothing here recommends a broker. Not recorded here means this site holds no record to answer from. It does not mean the broker or platform lacks it.
How each answer is built
The answer is the record's own sentence about authentication, cut at the end of a sentence. The whole wording is on the record's own page. The state beside it says whether that sentence names how a request is authenticated, as entered in the capability facts register.
24 of the 29 records below can answer this question. 3 of those answers rest on a record labelled unverified, 1 rests on sources that conflict, and 5 records are shown as not recorded here.
The state beside an answer is the cell the capability grid computes for the same record, shown as it stands there: Authentication described. It is a separate reading of the record, decided by the rule on its own page.
Brokers
| Record | Answer from the record | Auth | Status, source and date |
|---|---|---|---|
| Axi | Not recorded here | Not recorded | No record held |
| Bitget | Signed requests. Every REST request carries the headers ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP and ACCESS-PASSPHRASE. | Yes | Bitget API quick start, Header and Signaturechecked |
| Capital.com | POST /session with the X-CAP-API-KEY header plus login credentials returns CST and X-SECURITY-TOKEN, sent on later calls. The session expires after 10 minutes of inactivity. | Yes | Capital.com Public APIchecked |
| CMC Markets | Not recorded here | Not recorded | No record held |
| Deriv | Two routes: an OAuth 2.0 app, or a Personal Access Token the user generates and pastes into the app. Either way the token is sent as a bearer token. With a Personal Access Token, REST requests also need a Deriv-App-ID header. | Yes | Deriv API: authenticationchecked |
| Dukascopy | JForex API: the client connects with the platform's connection address, a username and a password. In live mode a connection from an IP address that is not registered also has to answer a captcha image for a PIN. | Yes | Dukascopy wiki, JForex SDK LIVE modechecked Dukascopy FIX API Programming Guide, revision 8.8.1checked |
| eToro | Headers x-api-key, x-user-key and x-request-id on every request, or an OAuth 2.0 bearer token instead of the key headers. eToro now states the exclusivity itself rather than leaving it to be inferred: a request presenting both is rejected. | Yes | eToro API portal: authenticationchecked SSO and OAuth, eToro API portalchecked |
| Exness | An API Key plus a Secret Key. | Yes | Exness help centre: Exness APIchecked |
| FOREX.com | A session token. POST your user name, password and the AppKey you were issued to /v2/Session, then send the returned session token and your user name with every request as the request headers Session and UserName. | Yes | StoneX API documentation, API basicschecked StoneX API documentation, LogOn v2checked |
| FXCM | FIX, the Java API and ForexConnect only. No REST API is listed on FXCM's current API pages, so the legacy REST token flow this site described is recorded as no longer listed rather than retired. | Not recorded | FXCM Socket REST API specchecked |
| FxPro | Not recorded here | Not recorded | No record held |
| IG | Sources conflict. API key plus username and password returns CST and X-SECURITY-TOKEN, valid 12 hours on a rolling basis with each call resetting the clock on the IG Labs FAQ, while IG's REST trading API guide says 6 hours at first, extended up to a maximum of 72 hours: a disagreement between two IG pages that the blocked reference page could not settle on 23 Sep 2026. The other reading: IG Labs FAQ: 12 hours between calls, reset by each call. IG Labs REST trading API guide: 6 hours at first, extended up to 72 hours while in use. | Yes | Sources conflictIG Labs REST trading API guidechecked IG Labs FAQchecked |
| Interactive Brokers | TWS API: local socket to a TWS or IB Gateway the user has logged in to by hand. | Yes | IBKR TWS API documentation, the IB Gatewaychecked IBKR Web API documentation, limitations of the Client Portal Gatewaychecked IBKR Web API v1.0 documentation, introductionchecked Client Portal API documentation, use cases (IBKR GitHub pages)checked |
| OANDA | Bearer personal access token, generated in the Account Management Portal after accepting the API licence. | Yes | Introduction, OANDA v20 REST APIchecked |
| Pepperstone | Unverified beyond one phrase. Pepperstone's API trading page, re-read 12 Oct 2026, says only that the Standard API uses an API key generated after approval. It names no header, signature or token lifetime, and nothing at all for the FIX route. | Partialunverified | UnverifiedPepperstone API tradingchecked |
| Saxo | OAuth 2.0 authorization code (with or without PKCE); app key and secret for live. Refresh tokens rotate: each is invalidated on use and replaced. Certificate-based auth is for select partners only, not retail. | Yes | Saxo OpenAPI Learnchecked |
| Swissquote | Unverified. The pages opened on 12 Oct 2026 do not describe how a session is authenticated. | Not recordedunverified | UnverifiedSwissquote institutional Forex APIschecked |
| ThinkMarkets | Not recorded here | Not recorded | No record held |
| Tickmill | Not recorded here | Not recorded | No record held |
| Trading 212 | HTTP Basic: Authorization header of Basic base64(API_KEY:API_SECRET). | Yes | Trading 212 API docs: authenticationchecked |
| XTB | Not applicable. XTB's help centre states that API access is no longer available and that the service was discontinued on 14 March 2025, so there is no authentication route left to document. Last looked for 9 Oct 2026. | No | XTB help centre: Does XTB offer investment automation tools?checked |
Platform APIs
| Record | Answer from the record | Auth | Status, source and date |
|---|---|---|---|
| cTrader | OAuth 2.0 authorisation code flow: the auth code lives 1 minute, the access token 30 days. Scopes are accounts, which is read only, and trading, which is full. | Yes | Account authenticationchecked |
| DXtrade | Unverified. The DXtrade developer portal at demo.dx.trade/developers returned only a page title without scripts on 12 Oct 2026, as it did in September, so the authentication scheme could not be read. | Not recordedunverified | UnverifiedDXtrade developer portal (content did not render)checked |
| Match-Trader | POST email, password and brokerId to /manager/co-login, or manager/login/co/with-token for a one time token. | Yes | Match-Trader Platform API PDF (2024)checked |
| MetaApi | An authorisation token sent in the auth-token header of every REST request. You take the token from the MetaApi web application. An invalid token returns HTTP 401. | Yes | MetaApi documentation, authentication and authorisationchecked |
| MetaCopier | API keys, of two kinds. A project level key, created under Projects then API Keys, reaches every account in the project. An account key is generated automatically when an account is created and reaches only that account. | Yes | MetaCopier documentation, REST APIchecked MetaCopier documentation, access policychecked MetaCopier documentation, Socket APIchecked |
| MetaTrader 4 | No API keys: code runs inside a terminal already logged in to a trading account. | Yes | MQL4 Referencechecked |
| MetaTrader 5 | No API keys: initialize() connects to the local terminal, optionally with account login, password and server. | Yes | initializechecked |
| TradeLocker | POST email, password and server to /auth/jwt/token; send the JWT as Bearer token; refresh tokens issued. /trade/* routes also need the accNum header (not the accountId). | Yes | Getting Started with TradeLocker Public APIchecked |
Where to go next
- Authentication: every record's full wording
- Authentication described: the capability table
- Log in and keep a session alive, broker by broker
- Staying logged in
- Answers for every broker and platform API
- Which retail brokers have a public trading API?
- Which broker APIs have a demo environment?
- What are the rate limits of each broker API?
- Which broker APIs stream prices?
- Which broker APIs have an official Python library?
- Which broker APIs have an MCP server?
- What does each API's most referenced error mean?