# eToro Authenticate

Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade.

This is the markdown version of https://openbrokerapi.com/brokers/etoro/messages/authenticate, written from the same records as that page.

Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.

Authenticates the WebSocket session with the user key and the API key, sent inside the message. It is needed before subscribing to the private topic, and public instrument topics do not need it.

- Message: `Authenticate`
- Interface: eToro WebSocket API
- Group: Control channel
- Status: verified. Source: [api-portal.etoro.com](https://api-portal.etoro.com/core/websocket/authentication.md), checked 2026-10-12.
- The definition file it was checked against: https://api-portal.etoro.com/api-reference/asyncapi.json

This is a message of the eToro WebSocket API, not an HTTP endpoint. It has no method and no path: it is sent as JSON over an open WebSocket connection. It is in no OpenAPI file on this site and the request builder does not list it.

Note: The page lists nine error codes for a failed Authenticate: SessionAlreadyAuthenticated, DataRequired, ApiKeyRequired, UserKeyRequired, TooManyRequests, Forbidden, UnhandledException, InvalidKey and Unauthorized. Each is recorded among this site's eToro error codes.

## The message

- Name: `Authenticate`
- Direction: Request, sent by the client
- Carried by: WebSocket.
- WebSocket address: `wss://ws.etoro.com/ws`

## Fields

- `id` (type string (uuid), required): An id you generate for the request. The acknowledgement carries the same value, which is how an answer is matched to its request.
- `operation` (type string, required): Always Authenticate.
- `data` (type object, required): Holds the two keys.
- `data.userKey` (type string, required): Your eToro user key, the value REST calls send as x-user-key.
- `data.apiKey` (type string, required): Your eToro API key, the value REST calls send as x-api-key.

## What arrives

An acknowledgement on the same connection. It repeats the id and the operation, and success says whether the Authenticate request was accepted.

- `id` (type string (uuid), required): The id of the request being acknowledged.
- `success` (type boolean, required): true where the request was accepted, false where it was not.
- `operation` (type string, required): The operation being acknowledged: Authenticate, Subscribe or Unsubscribe.
- `errorMessage` (type string, optional): A message, present where success is false.
- `errorCode` (type string, optional): An error code, present where success is false.

## Sample

Written by this site from the fields recorded on this page. It has not been run against a terminal, a server or an account, and the values in it are placeholders. No credential is typed into it: where a field holds one, the placeholder says where it comes from. Nothing is entered on this site.

```json
{
  "id": "ed72693c-1545-4fa1-8a10-aca7cf5419a6",
  "operation": "Authenticate",
  "data": {
    "userKey": "<your user key, from your own environment>",
    "apiKey": "<your API key, from your own environment>"
  }
}
```

## Limits that apply at eToro

- Headline limit: 60/min reads per key
  - Scope: user
  - Status: verified. Source: [api-portal.etoro.com](https://api-portal.etoro.com/core/getting-started/rate-limits.md), checked 2026-09-20.
  - Note: Most GET calls. Trading and writes: 20 a minute. Tracked per user key over a one minute rolling window, 429 on excess. The page states no response headers, and the 120 per 60 seconds market data quota carried from earlier readings is now unverified.

## Related eToro messages: Control channel

- [Subscribe](https://openbrokerapi.com/brokers/etoro/messages/subscribe): Starts delivery of one topic or several: instrument:{instrumentId} for live rates, candle:{instrumentId} for candles, or private for the logged in user's order updates. An acknowledgement follows, then the pushes.
- [Unsubscribe](https://openbrokerapi.com/brokers/etoro/messages/unsubscribe): Stops delivery of the topics named. The connection stays open and other subscriptions are not touched.

## More on eToro

- [All eToro messages](https://openbrokerapi.com/brokers/etoro/messages): 6 documented here, grouped by what they do.
- [Log in and keep a session: the call at each API](https://openbrokerapi.com/endpoints/session): The same job at every broker and platform API recorded here, HTTP or not.
- [eToro API quickstart](https://openbrokerapi.com/brokers/etoro/quickstart)
- [All eToro error codes](https://openbrokerapi.com/errors/etoro)
- [eToro API page](https://openbrokerapi.com/brokers/etoro): The full record: access, authentication, limits and the source for each.

## Licence and how to cite

The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page.

Cite as: eToro Authenticate. Broker API Hub, https://openbrokerapi.com/brokers/etoro/messages/authenticate, newest check 2026-10-12.

Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.