eToro Authenticate

messageAuthenticateeToro WebSocket APIWebSocketControl channel

Authenticates the WebSocket session with the user key and the API key, sent inside the message. It is needed before subscribing to the private topic, and public instrument topics do not need it.

Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.

Independent and unofficialapi-portal.etoro.comchecked 12 Oct 2026The definition file it was checked against

This is a message of the eToro WebSocket API, not an HTTP endpoint. It has no method and no path: it is sent as JSON over an open WebSocket connection.

The page lists nine error codes for a failed Authenticate: SessionAlreadyAuthenticated, DataRequired, ApiKeyRequired, UserKeyRequired, TooManyRequests, Forbidden, UnhandledException, InvalidKey and Unauthorized. Each is recorded among this site's eToro error codes.

The message

Name: Authenticate
Direction: Request, sent by the client
Carried by: WebSocket.
WebSocket address: wss://ws.etoro.com/ws

Fields

Name	Type	Description
idrequired	string (uuid)	An id you generate for the request. The acknowledgement carries the same value, which is how an answer is matched to its request.
operationrequired	string	Always Authenticate.
datarequired	object	Holds the two keys.
data.userKeyrequired	string	Your eToro user key, the value REST calls send as x-user-key.
data.apiKeyrequired	string	Your eToro API key, the value REST calls send as x-api-key.

What arrives

An acknowledgement on the same connection. It repeats the id and the operation, and success says whether the Authenticate request was accepted.

Name	Type	Description
idrequired	string (uuid)	The id of the request being acknowledged.
successrequired	boolean	true where the request was accepted, false where it was not.
operationrequired	string	The operation being acknowledged: Authenticate, Subscribe or Unsubscribe.
errorMessage	string	A message, present where success is false.
errorCode	string	An error code, present where success is false.

Sample

Written by this site from the fields recorded on this page. It has not been run against a terminal, a server or an account, and the values in it are placeholders. No credential is typed into it: where a field holds one, the placeholder says where it comes from. Nothing is entered on this site.

{
  "id": "ed72693c-1545-4fa1-8a10-aca7cf5419a6",
  "operation": "Authenticate",
  "data": {
    "userKey": "<your user key, from your own environment>",
    "apiKey": "<your API key, from your own environment>"
  }
}

Limits that apply at eToro

Limit	Value	Scope	Source
Headline limit	60/min reads per key	user	api-portal.etoro.comchecked 20 Sep 2026