Broker APIs with authentication described

Authentication is how an API knows a request is yours: a key or token sent with every request, a login call that returns a session token, or OAuth. You need to know which before you can make a first call.

Independent and unofficialNewest check 12 Oct 2026

Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.

Not recorded means this site holds no record. It does not mean the broker or platform lacks it. Rows are in name order, the order is not a ranking, and nothing here recommends a broker.

How each row is decided

Each record holds a sentence about authentication, not a yes or no field. A person read each sentence and entered a state in the capability facts register only where its own words settle it. Yes means the sentence names how a request is authenticated, which includes a platform whose code runs inside a terminal that is already logged in. Partial means it names part of it. No means the record says there is no authentication route, for example because the API was withdrawn. The status, the source and the date are the sentence's own. A record with no such sentence, or one that says the method could not be read, stays at not recorded.

Yes: A record on this site says so: a structured field, a record that exists, or a sentence in a record that was read and entered in the capability facts register, with the reason printed beside it. 19 of the 29 rows below.
Partial: A sentence in a record gives part of it: one route and not another, or a demo of the platform and not of the API. The reading is a row of the capability facts register, and the reason and the scope are printed beside it. 1 of the 29 rows below.
No: A record on this site says no: a structured field set to false, or a sentence in a record that says so, read and entered in the capability facts register. 1 of the 29 rows below.
Not recorded: This site holds no yes or no for it. That is a gap in this dataset. It is not a statement that the broker or platform lacks the capability. 8 of the 29 rows below.

3 of the rows rest on a record that is labelled unverified. Each says so beside its source.

Brokers

Record	State	What the record holds	Source and date
Axi	Not recorded	The record holds no statement about authentication.	No record held
Bitget	Yes	The record says every REST request carries four access headers, with a signature made by HMAC SHA256 or with an RSA private key. Signed requests. Every REST request carries the headers ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP and ACCESS-PASSPHRASE. Shortened at the end of a sentence. Read the full wording	Bitget API quick start, Header and Signaturechecked 12 Oct 2026
Capital.com	Yes	The record says a POST to /session with the API key header and login credentials returns two session tokens that are sent on later calls. POST /session with the X-CAP-API-KEY header plus login credentials returns CST and X-SECURITY-TOKEN, sent on later calls. The session expires after 10 minutes of inactivity. Read the record	Capital.com Public APIchecked 12 Oct 2026
CMC Markets	Not recorded	The record holds no statement about authentication.	No record held
Deriv	Yes	The record says an OAuth 2.0 app or a Personal Access Token is used, and that either way the token is sent as a bearer token. Two routes: an OAuth 2.0 app, or a Personal Access Token the user generates and pastes into the app. Either way the token is sent as a bearer token. With a Personal Access Token, REST requests also need a Deriv-App-ID header. Read the record	Deriv API: authenticationchecked 12 Oct 2026
Dukascopy	Yes	The record says the JForex API connects with a username and password, and the FIX API with a Logon message over an SSL socket from an agreed IP address. JForex API: the client connects with the platform's connection address, a username and a password. In live mode a connection from an IP address that is not registered also has to answer a captcha image for a PIN. Shortened at the end of a sentence. Read the full wording	Dukascopy wiki, JForex SDK LIVE modechecked 12 Oct 2026
eToro	Yes	The record says requests carry the x-api-key, x-user-key and x-request-id headers, or an OAuth 2.0 bearer token in place of the key headers. Headers x-api-key, x-user-key and x-request-id on every request, or an OAuth 2.0 bearer token instead of the key headers. eToro now states the exclusivity itself rather than leaving it to be inferred: a request presenting both is rejected. Read the record	eToro API portal: authenticationchecked 12 Oct 2026
Exness	Yes	The record says authentication is an API Key plus a Secret Key. Scope: The record names the two keys and nothing about headers or signing. An API Key plus a Secret Key. Read the record	Exness help centre: Exness APIchecked 23 Sep 2026
FOREX.com / StoneX Trading (City Index)	Yes	The record says a POST to /v2/Session with user name, password and AppKey returns a session token that is sent with every request. A session token. POST your user name, password and the AppKey you were issued to /v2/Session, then send the returned session token and your user name with every request as the request headers Session and UserName. Shortened at the end of a sentence. Read the full wording	StoneX API documentation, API basicschecked 12 Oct 2026
FXCM	Not recorded	No state is taken from the record's sentence about authentication: the capability facts register holds no reading of it as a yes, a partial or a no. FIX, the Java API and ForexConnect only. No REST API is listed on FXCM's current API pages, so the legacy REST token flow this site described is recorded as no longer listed rather than retired. Read the record	FXCM Socket REST API specchecked 21 Sep 2026
FxPro	Not recorded	The record holds no statement about authentication.	No record held
IG	Yes	The record says an API key with a username and password returns two session tokens, and that a v3 login returns OAuth tokens. Scope: The method is recorded. The record holds two readings of how long a session token lasts. API key plus username and password returns CST and X-SECURITY-TOKEN, valid 12 hours on a rolling basis with each call resetting the clock on the IG Labs FAQ, while IG's REST trading API guide says 6 hours at first, extended up to a maximum of 72 hours: a disagreement between two IG pages that the blocked reference page could not settle on 23 Sep 2026. Shortened at the end of a sentence. Read the full wording	IG Labs REST trading API guidechecked 12 Oct 2026Sources conflict
Interactive Brokers	Yes	The record says the TWS API uses a local socket to a logged in TWS or Gateway, and the Web API a browser login through the Client Portal Gateway. TWS API: local socket to a TWS or IB Gateway the user has logged in to by hand. Shortened at the end of a sentence. Read the full wording	IBKR TWS API documentation, the IB Gatewaychecked 12 Oct 2026
OANDA	Yes	The record says a personal access token is sent as a bearer token. Bearer personal access token, generated in the Account Management Portal after accepting the API licence. Read the record	Introduction, OANDA v20 REST APIchecked 12 Oct 2026
Pepperstone	Partial	The record says only that the Standard API uses an API key generated after approval, with no header, signature or token lifetime named. Scope: Standard API only. Nothing is recorded for the FIX route. Unverified beyond one phrase. Pepperstone's API trading page, re-read 12 Oct 2026, says only that the Standard API uses an API key generated after approval. Shortened at the end of a sentence. Read the full wording	UnverifiedPepperstone API tradingchecked 12 Oct 2026
Saxo OpenAPI	Yes	The record says the OAuth 2.0 authorization code flow is used, with or without PKCE, and that refresh tokens rotate. OAuth 2.0 authorization code (with or without PKCE); app key and secret for live. Refresh tokens rotate: each is invalidated on use and replaced. Certificate-based auth is for select partners only, not retail. Read the record	Saxo OpenAPI Learnchecked 20 Sep 2026
Swissquote	Not recorded	No state is taken from the record's sentence about authentication: the capability facts register holds no reading of it as a yes, a partial or a no. Unverified. The pages opened on 12 Oct 2026 do not describe how a session is authenticated. Shortened at the end of a sentence. Read the full wording	UnverifiedSwissquote institutional Forex APIschecked 12 Oct 2026
ThinkMarkets	Not recorded	The record holds no statement about authentication.	No record held
Tickmill	Not recorded	The record holds no statement about authentication.	No record held
Trading 212	Yes	The record says HTTP Basic authentication is used, with the API key and secret in the Authorization header. HTTP Basic: Authorization header of Basic base64(API_KEY:API_SECRET). Read the record	Trading 212 API docs: authenticationchecked 12 Oct 2026
XTB	No	The record says API access was discontinued on 14 March 2025, so there is no authentication route left to document. Not applicable. XTB's help centre states that API access is no longer available and that the service was discontinued on 14 March 2025, so there is no authentication route left to document. Last looked for 9 Oct 2026. Read the record	XTB help centre: Does XTB offer investment automation tools?checked 9 Oct 2026

Platform APIs

Record	State	What the record holds	Source and date
cTrader Open API	Yes	The record says the OAuth 2.0 authorisation code flow is used, with an access token that lasts 30 days. OAuth 2.0 authorisation code flow: the auth code lives 1 minute, the access token 30 days. Scopes are accounts, which is read only, and trading, which is full. Read the record	Account authenticationchecked 20 Sep 2026
DXtrade APIs	Not recorded	No state is taken from the record's sentence about authentication: the capability facts register holds no reading of it as a yes, a partial or a no. Unverified. The DXtrade developer portal at demo.dx.trade/developers returned only a page title without scripts on 12 Oct 2026, as it did in September, so the authentication scheme could not be read. Shortened at the end of a sentence. Read the full wording	UnverifiedDXtrade developer portal (content did not render)checked 12 Oct 2026
Match-Trader Platform API	Yes	The record says a login call with email, password and broker id sets cookies, and that trading calls also need an Auth-trading-api header. POST email, password and brokerId to /manager/co-login, or manager/login/co/with-token for a one time token. Shortened at the end of a sentence. Read the full wording	Match-Trader Platform API PDF (2024)checked 21 Sep 2026
MetaApi	Yes	The record says an authorisation token is sent in the auth-token header of every REST request. An authorisation token sent in the auth-token header of every REST request. You take the token from the MetaApi web application. An invalid token returns HTTP 401. Read the record	MetaApi documentation, authentication and authorisationchecked 12 Oct 2026
MetaCopier	Yes	The record says API keys are used, at project level or at account level, and that the Socket API takes the same key. API keys, of two kinds. A project level key, created under Projects then API Keys, reaches every account in the project. An account key is generated automatically when an account is created and reaches only that account. Shortened at the end of a sentence. Read the full wording	MetaCopier documentation, REST APIchecked 12 Oct 2026
MetaTrader 4 (MQL4)	Yes	The record says no API key is used: code runs inside a terminal that is already logged in to a trading account. Scope: No separate API login. The terminal's own login is the authentication. No API keys: code runs inside a terminal already logged in to a trading account. Read the record	MQL4 Referencechecked 20 Sep 2026
MetaTrader 5 (Python package and MQL5)	Yes	The record says no API key is used: initialize() connects to the local terminal, optionally with an account login, password and server. Scope: No separate API key. The connection is to the local terminal. No API keys: initialize() connects to the local terminal, optionally with account login, password and server. Read the record	initializechecked 20 Sep 2026
TradeLocker API	Yes	The record says a POST of email, password and server returns a JWT that is sent as a bearer token, with refresh tokens issued. POST email, password and server to /auth/jwt/token; send the JWT as Bearer token; refresh tokens issued. /trade/* routes also need the accNum header (not the accountId). Read the record	Getting Started with TradeLocker Public APIchecked 20 Sep 2026

Where to go next

How to cite this

Broker APIs with authentication described. Broker API Hub, https://openbrokerapi.com/capabilities/authentication, newest check 12 Oct 2026.

Where you rely on a single figure, cite the source and the checked date printed beside it as well.