# How does each broker API authenticate? Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade. This is the markdown version of https://openbrokerapi.com/answers/authentication, written from the same records as that page. Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders. Authentication is how an API knows a request is yours. The common patterns are a key or token sent with every request, a login call that returns a session token which expires, and OAuth. - Newest check: 2026-10-12 Rows are in name order. The order is not a ranking and nothing here recommends a broker. Not recorded here means this site holds no record to answer from. It does not mean the broker or platform lacks it. ## How each answer is built The answer is the record's own sentence about authentication, cut at the end of a sentence. The whole wording is on the record's own page. The state beside it says whether that sentence names how a request is authenticated, as entered in the capability facts register. 24 of the 29 records below can answer this question. 3 of those answers rest on a record labelled unverified, 1 rest on sources that conflict, and 5 records are shown as not recorded here. The state beside an answer is the cell the capability grid (https://openbrokerapi.com/capabilities) computes for the same record: [Authentication described](https://openbrokerapi.com/capabilities/authentication). It is a separate reading of the record, decided by the rule on its own page. ## Brokers ### Axi Not recorded here. No record held. - Authentication described: Not recorded - [The Axi record](https://openbrokerapi.com/brokers/axi) ### Bitget Signed requests. Every REST request carries the headers ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP and ACCESS-PASSPHRASE. - Status: verified. Source: [Bitget API quick start, Header and Signature](https://www.bitget.com/docs/uta/quick-start), checked 2026-10-12. - [The Bitget record's full wording](https://openbrokerapi.com/brokers/bitget#access) - Authentication described: Yes - [Bitget API: questions and answers](https://openbrokerapi.com/answers/bitget) ### Capital.com POST /session with the X-CAP-API-KEY header plus login credentials returns CST and X-SECURITY-TOKEN, sent on later calls. The session expires after 10 minutes of inactivity. - Status: verified. Source: [Capital.com Public API](https://open-api.capital.com/), checked 2026-10-12. - [The Capital.com record's full wording](https://openbrokerapi.com/brokers/capital-com#access) - Authentication described: Yes - [Capital.com API: questions and answers](https://openbrokerapi.com/answers/capital-com) ### CMC Markets Not recorded here. No record held. - Authentication described: Not recorded - [The CMC Markets record](https://openbrokerapi.com/brokers/cmc-markets) ### Deriv Two routes: an OAuth 2.0 app, or a Personal Access Token the user generates and pastes into the app. Either way the token is sent as a bearer token. With a Personal Access Token, REST requests also need a Deriv-App-ID header. - Status: verified. Source: [Deriv API: authentication](https://developers.deriv.com/docs/intro/authentication/), checked 2026-10-12. - [The Deriv record's full wording](https://openbrokerapi.com/brokers/deriv#access) - Authentication described: Yes - [Deriv API: questions and answers](https://openbrokerapi.com/answers/deriv) ### Dukascopy JForex API: the client connects with the platform's connection address, a username and a password. In live mode a connection from an IP address that is not registered also has to answer a captcha image for a PIN. - Status: verified. Source: [Dukascopy wiki, JForex SDK LIVE mode](https://www.dukascopy.com/wiki/en/development/get-started-api/use-jforex-sdk/live-mode/), checked 2026-10-12. - Status: verified. Source: [Dukascopy FIX API Programming Guide, revision 8.8.1](https://www.dukascopy.com/media-storage/3000474271/o/), checked 2026-10-12. - [The Dukascopy record's full wording](https://openbrokerapi.com/brokers/dukascopy#access) - Authentication described: Yes - [Dukascopy API: questions and answers](https://openbrokerapi.com/answers/dukascopy) ### eToro Headers x-api-key, x-user-key and x-request-id on every request, or an OAuth 2.0 bearer token instead of the key headers. eToro now states the exclusivity itself rather than leaving it to be inferred: a request presenting both is rejected. - Status: verified. Source: [eToro API portal: authentication](https://api-portal.etoro.com/core/getting-started/authentication.md), checked 2026-10-12. - Status: verified. Source: [SSO and OAuth, eToro API portal](https://api-portal.etoro.com/core/getting-started/sso-oauth.md), checked 2026-10-12. - [The eToro record's full wording](https://openbrokerapi.com/brokers/etoro#access) - Authentication described: Yes - [eToro API: questions and answers](https://openbrokerapi.com/answers/etoro) ### Exness An API Key plus a Secret Key. - Status: verified. Source: [Exness help centre: Exness API](https://get.exness.help/hc/en-us/articles/27866287512476-Exness-API), checked 2026-09-23. - [The Exness record's full wording](https://openbrokerapi.com/brokers/exness#access) - Authentication described: Yes - [Exness API: questions and answers](https://openbrokerapi.com/answers/exness) ### FOREX.com A session token. POST your user name, password and the AppKey you were issued to /v2/Session, then send the returned session token and your user name with every request as the request headers Session and UserName. - Status: verified. Source: [StoneX API documentation, API basics](https://docs.labs.gaincapital.com/Content/Getting%20Started/CIAPI%20Basics.htm), checked 2026-10-12. - Status: verified. Source: [StoneX API documentation, LogOn v2](https://docs.labs.gaincapital.com/Content/HTTP%20Services/LogOn%20v2.htm), checked 2026-10-12. - [The FOREX.com record's full wording](https://openbrokerapi.com/brokers/forex-com-city-index#access) - Authentication described: Yes - [FOREX.com API: questions and answers](https://openbrokerapi.com/answers/forex-com-city-index) ### FXCM FIX, the Java API and ForexConnect only. No REST API is listed on FXCM's current API pages, so the legacy REST token flow this site described is recorded as no longer listed rather than retired. - Status: verified. Source: [FXCM Socket REST API spec](https://fxcm-rest.readthedocs.io/en/latest/socketrestapispecs.html), checked 2026-09-21. - [The FXCM record's full wording](https://openbrokerapi.com/brokers/fxcm#access) - Authentication described: Not recorded - [FXCM API: questions and answers](https://openbrokerapi.com/answers/fxcm) ### FxPro Not recorded here. No record held. - Authentication described: Not recorded - [The FxPro record](https://openbrokerapi.com/brokers/fxpro) ### IG Sources conflict. API key plus username and password returns CST and X-SECURITY-TOKEN, valid 12 hours on a rolling basis with each call resetting the clock on the IG Labs FAQ, while IG's REST trading API guide says 6 hours at first, extended up to a maximum of 72 hours: a disagreement between two IG pages that the blocked reference page could not settle on 23 Sep 2026. The other reading: IG Labs FAQ: 12 hours between calls, reset by each call. IG Labs REST trading API guide: 6 hours at first, extended up to 72 hours while in use. - Status: conflicting. Source: [IG Labs REST trading API guide](https://labs.ig.com/rest-trading-api-guide.html), checked 2026-10-12. - Status: conflicting. Source: [IG Labs FAQ](https://labs.ig.com/faq.html), checked 2026-10-12. - [The IG record's full wording](https://openbrokerapi.com/brokers/ig#access) - Authentication described: Yes - [IG API: questions and answers](https://openbrokerapi.com/answers/ig) ### Interactive Brokers TWS API: local socket to a TWS or IB Gateway the user has logged in to by hand. - Status: verified. Source: [IBKR TWS API documentation, the IB Gateway](https://www.interactivebrokers.com/docs/tws-api/doc/architecture/the-trader-workstation/the-ib-gateway), checked 2026-10-12. - Status: verified. Source: [IBKR Web API documentation, limitations of the Client Portal Gateway](https://www.interactivebrokers.com/docs/web-api/authentication/cpgw/limitations-of-the-client-portal-gateway), checked 2026-10-12. - Status: verified. Source: [IBKR Web API v1.0 documentation, introduction](https://www.interactivebrokers.com/docs/web-api/v1/introduction), checked 2026-10-12. - Status: verified. Source: [Client Portal API documentation, use cases (IBKR GitHub pages)](https://interactivebrokers.github.io/cpwebapi/use-cases), checked 2026-10-12. - [The Interactive Brokers record's full wording](https://openbrokerapi.com/brokers/ibkr#access) - Authentication described: Yes - [Interactive Brokers API: questions and answers](https://openbrokerapi.com/answers/ibkr) ### OANDA Bearer personal access token, generated in the Account Management Portal after accepting the API licence. - Status: verified. Source: [Introduction, OANDA v20 REST API](https://developer.oanda.com/rest-live-v20/introduction/), checked 2026-10-12. - [The OANDA record's full wording](https://openbrokerapi.com/brokers/oanda#access) - Authentication described: Yes - [OANDA API: questions and answers](https://openbrokerapi.com/answers/oanda) ### Pepperstone Unverified beyond one phrase. Pepperstone's API trading page, re-read 12 Oct 2026, says only that the Standard API uses an API key generated after approval. It names no header, signature or token lifetime, and nothing at all for the FIX route. - Status: unverified. Source: [Pepperstone API trading](https://pepperstone.com/en/platforms/tools/api-trading), checked 2026-10-12. - [The Pepperstone record's full wording](https://openbrokerapi.com/brokers/pepperstone#access) - Authentication described: Partial - [Pepperstone API: questions and answers](https://openbrokerapi.com/answers/pepperstone) ### Saxo OAuth 2.0 authorization code (with or without PKCE); app key and secret for live. Refresh tokens rotate: each is invalidated on use and replaced. Certificate-based auth is for select partners only, not retail. - Status: verified. Source: [Saxo OpenAPI Learn](https://www.developer.saxo/openapi/learn), checked 2026-09-20. - [The Saxo record's full wording](https://openbrokerapi.com/brokers/saxo#access) - Authentication described: Yes - [Saxo API: questions and answers](https://openbrokerapi.com/answers/saxo) ### Swissquote Unverified. The pages opened on 12 Oct 2026 do not describe how a session is authenticated. - Status: unverified. Source: [Swissquote institutional Forex APIs](https://www.swissquote.com/en/institutional/solutions/technology/apis/forex), checked 2026-10-12. - [The Swissquote record's full wording](https://openbrokerapi.com/brokers/swissquote#access) - Authentication described: Not recorded - [Swissquote API: questions and answers](https://openbrokerapi.com/answers/swissquote) ### ThinkMarkets Not recorded here. No record held. - Authentication described: Not recorded - [The ThinkMarkets record](https://openbrokerapi.com/brokers/thinkmarkets) ### Tickmill Not recorded here. No record held. - Authentication described: Not recorded - [The Tickmill record](https://openbrokerapi.com/brokers/tickmill) ### Trading 212 HTTP Basic: Authorization header of Basic base64(API_KEY:API_SECRET). - Status: verified. Source: [Trading 212 API docs: authentication](https://docs.trading212.com/api/section/authentication), checked 2026-10-12. - [The Trading 212 record's full wording](https://openbrokerapi.com/brokers/trading-212#access) - Authentication described: Yes - [Trading 212 API: questions and answers](https://openbrokerapi.com/answers/trading-212) ### XTB Not applicable. XTB's help centre states that API access is no longer available and that the service was discontinued on 14 March 2025, so there is no authentication route left to document. Last looked for 9 Oct 2026. - Status: verified. Source: [XTB help centre: Does XTB offer investment automation tools?](https://www.xtb.com/cy/help-center/our-platforms/does-xtb-offer-investment-automation-tools), checked 2026-10-09. - [The XTB record's full wording](https://openbrokerapi.com/brokers/xtb#access) - Authentication described: No - [XTB API: questions and answers](https://openbrokerapi.com/answers/xtb) ## Platform APIs ### cTrader OAuth 2.0 authorisation code flow: the auth code lives 1 minute, the access token 30 days. Scopes are accounts, which is read only, and trading, which is full. - Status: verified. Source: [Account authentication](https://help.ctrader.com/open-api/account-authentication/), checked 2026-09-20. - [The cTrader record's full wording](https://openbrokerapi.com/platforms/ctrader#access) - Authentication described: Yes - [cTrader API: questions and answers](https://openbrokerapi.com/answers/ctrader) ### DXtrade Unverified. The DXtrade developer portal at demo.dx.trade/developers returned only a page title without scripts on 12 Oct 2026, as it did in September, so the authentication scheme could not be read. - Status: unverified. Source: [DXtrade developer portal (content did not render)](https://demo.dx.trade/developers/), checked 2026-10-12. - [The DXtrade record's full wording](https://openbrokerapi.com/platforms/dxtrade#access) - Authentication described: Not recorded - [DXtrade API: questions and answers](https://openbrokerapi.com/answers/dxtrade) ### Match-Trader POST email, password and brokerId to /manager/co-login, or manager/login/co/with-token for a one time token. - Status: verified. Source: [Match-Trader Platform API PDF (2024)](https://docs.match-trade.com/wp-content/uploads/2024/05/MTR-Match-TraderPlatformAPI.pdf), checked 2026-09-21. - [The Match-Trader record's full wording](https://openbrokerapi.com/platforms/match-trader#access) - Authentication described: Yes - [Match-Trader API: questions and answers](https://openbrokerapi.com/answers/match-trader) ### MetaApi An authorisation token sent in the auth-token header of every REST request. You take the token from the MetaApi web application. An invalid token returns HTTP 401. - Status: verified. Source: [MetaApi documentation, authentication and authorisation](https://metaapi.cloud/docs/client/restApi/auth/), checked 2026-10-12. - [The MetaApi record's full wording](https://openbrokerapi.com/platforms/metaapi#access) - Authentication described: Yes - [MetaApi API: questions and answers](https://openbrokerapi.com/answers/metaapi) ### MetaCopier API keys, of two kinds. A project level key, created under Projects then API Keys, reaches every account in the project. An account key is generated automatically when an account is created and reaches only that account. - Status: verified. Source: [MetaCopier documentation, REST API](https://docs.metacopier.io/rest-api/api), checked 2026-10-12. - Status: verified. Source: [MetaCopier documentation, access policy](https://docs.metacopier.io/rest-api/access-policy), checked 2026-10-12. - Status: verified. Source: [MetaCopier documentation, Socket API](https://docs.metacopier.io/socket-api/api), checked 2026-10-12. - [The MetaCopier record's full wording](https://openbrokerapi.com/platforms/metacopier#access) - Authentication described: Yes - [MetaCopier API: questions and answers](https://openbrokerapi.com/answers/metacopier) ### MetaTrader 4 No API keys: code runs inside a terminal already logged in to a trading account. - Status: verified. Source: [MQL4 Reference](https://docs.mql4.com/), checked 2026-09-20. - [The MetaTrader 4 record's full wording](https://openbrokerapi.com/platforms/metatrader-4#access) - Authentication described: Yes - [MetaTrader 4 API: questions and answers](https://openbrokerapi.com/answers/metatrader-4) ### MetaTrader 5 No API keys: initialize() connects to the local terminal, optionally with account login, password and server. - Status: verified. Source: [initialize](https://www.mql5.com/en/docs/python_metatrader5/mt5initialize_py), checked 2026-09-20. - [The MetaTrader 5 record's full wording](https://openbrokerapi.com/platforms/metatrader-5#access) - Authentication described: Yes - [MetaTrader 5 API: questions and answers](https://openbrokerapi.com/answers/metatrader-5) ### TradeLocker POST email, password and server to /auth/jwt/token; send the JWT as Bearer token; refresh tokens issued. /trade/\* routes also need the accNum header (not the accountId). - Status: verified. Source: [Getting Started with TradeLocker Public API](https://public-api.tradelocker.com/), checked 2026-09-20. - [The TradeLocker record's full wording](https://openbrokerapi.com/platforms/tradelocker#access) - Authentication described: Yes - [TradeLocker API: questions and answers](https://openbrokerapi.com/answers/tradelocker) ## Where to go next - [Answers for every broker and platform API](https://openbrokerapi.com/answers) - [Authentication: every record's full wording](https://openbrokerapi.com/across-brokers/authentication) - [Authentication described: the capability table](https://openbrokerapi.com/capabilities/authentication) - [Log in and keep a session alive, broker by broker](https://openbrokerapi.com/endpoints/session) - [Staying logged in](https://openbrokerapi.com/guides/staying-logged-in) ## Licence and how to cite The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page. Cite as: How does each broker API authenticate?. Broker API Hub, https://openbrokerapi.com/answers/authentication, newest check 2026-10-12. Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.