Log in and keep a session alive: broker API endpoints compared
21 documented calls from 6 of the 12 APIs with endpoint records here, and 14 functions and messages from 8 APIs whose interfaces are not HTTP, each with the page it was read on.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
What this task is
Some APIs make you open a session first: you log in once, receive a token, and send that token with every later call. Sessions expire, so a long running program must either keep the session alive or log in again when it lapses.
Other APIs have no session call at all and take a long lived token or key on each request. A provider with no entry below may simply work that way. Never type a real password or key into a web page that is not the provider's own.
The documented endpoint, API by API
Ordered by the name of the broker or platform API, then by path. The order is not a ranking. Open a row for the parameters, the response and a sample request.
| Broker or platform | Endpoint | What the record says it does | Source |
|---|---|---|---|
| Capital.com | GET/api/v1/ping | Ping the service to keep a trading session alive. Call it at least once every 10 minutes when idle. | open-api.capital.comchecked |
| Capital.com | DELETE/api/v1/session | Log out of the current session. The CST and X-SECURITY-TOKEN tokens stop working. | open-api.capital.comchecked |
| Capital.com | POST/api/v1/session | Log in with your API key, login identifier and API key password. The CST and X-SECURITY-TOKEN tokens come back in the response headers. | open-api.capital.comchecked |
| Capital.com | PUT/api/v1/session | Switch the session to another of your financial accounts. Later calls then act on that account. | open-api.capital.comchecked |
| Capital.com | GET/api/v1/session | Read the current session: client ID, active account, locale, currency and the streaming endpoint. | open-api.capital.comchecked |
| DXtrade APIs | POST/login | Log in with a username, a domain and a password and receive a session token to send with every later request. | demo.dx.tradechecked |
| DXtrade APIs | POST/loginByToken | Create a session token from a single sign on token in place of a password, for a system that holds no credentials of its own. | demo.dx.tradechecked |
| DXtrade APIs | POST/logout | End a token authentication session at once, so the session token stops working. | demo.dx.tradechecked |
| DXtrade APIs | POST/ping | Reset the expiry of a token authentication session without doing anything else. Not needed with HMAC authentication. | demo.dx.tradechecked |
| IG | DELETE/session | Log out and end the current session. The page documents no parameters and no response body. | labs.ig.comchecked |
| IG | POST/session | Log in with username and password. Returns CST and X-SECURITY-TOKEN in the response headers; send both on every later call. | labs.ig.comchecked |
| IG | PUT/session | Switch the session to another of your accounts, and optionally make that account the default one. | labs.ig.comchecked |
| IG | GET/session | Read the current session: client ID, active account and streaming endpoint. Optional fetchSessionTokens=true returns fresh CST headers. | labs.ig.comchecked |
| Interactive Brokers | POST/iserver/auth/ssodh/init | Starts the brokerage session. IBKR documents it for OAuth users after the access token and live session token steps. | interactivebrokers.comchecked |
| Interactive Brokers | POST/iserver/auth/status | Whether your brokerage session is authenticated, fully established and free of a competing session. Call it after you log in through the gateway. | interactivebrokers.comchecked |
| Interactive Brokers | POST/logout | Logs you out of the gateway session. Any further call needs a new login, and IBKR says to discard client side cookies. | interactivebrokers.comchecked |
| Interactive Brokers | POST/tickle | Pings the server so the session does not time out. IBKR expects a call about every 60 seconds. | interactivebrokers.comchecked |
| Match-Trader Platform API | POST/manager/mtr-login | Log in with an email, a password and the broker's identifier and receive the tokens the other calls need, with the login's trading accounts. | app.theneo.iochecked |
| Match-Trader Platform API | POST/manager/refresh-token | Renew the session token without logging in again. The reference says the refresh token travels as a cookie. | app.theneo.iochecked |
| TradeLocker API | POST/auth/jwt/refresh | Exchange a refresh token for a new access token and a new refresh token, without sending the password again. | public-api.tradelocker.comchecked |
| TradeLocker API | POST/auth/jwt/token | Log in with an email, a password and a server name and receive an access token and a refresh token. | public-api.tradelocker.comchecked |
The same task where the interface is not HTTP
Some platform APIs, and the streaming interfaces of some broker APIs, are not sent as HTTP requests. A function is called from a program in its language, and a message is sent over an open connection. None has a method or a path, so each row is labelled with its kind and its interface. A record is put on this page by hand, from what the vendor's page says the call does, and one call can do several jobs, so the same function can be on more than one task page. Ordered by the name of the broker or platform API, then interface, then name.
| API | Call | What the record says it does | Source |
|---|---|---|---|
| Bitget | messagelogin Bitget WebSocket API | Logs a WebSocket connection in, so that private channels can be subscribed to. It carries the API key, its passphrase, a timestamp and a signature of that timestamp made with the secret key. Bitget says a failed login disconnects the connection. | bitget.comchecked |
| Bitget | messageping Bitget WebSocket API | Keeps a connection alive. It is the plain string ping, not JSON, and the server answers with the string pong. Bitget recommends sending it every 30 seconds and says the server disconnects after 2 minutes without one. | bitget.comchecked |
| Capital.com | messageping Capital.com WebSocket API | Keeps the WebSocket connection alive. Capital.com's page says to send it at least once every 10 minutes. It carries the two session tokens and no payload. | open-api.capital.comchecked |
| cTrader Open API | messageProtoOAAccountAuthReq cTrader Open API | Opens a session for one trading account on a connection where the application is already authorised, using the access token granted for that account. | help.ctrader.comchecked |
| cTrader Open API | messageProtoOAAccountLogoutReq cTrader Open API | Asks to end the session of one trading account on this connection. | help.ctrader.comchecked |
| cTrader Open API | messageProtoOAApplicationAuthReq cTrader Open API | Authorises the application on a newly opened connection, with the client id and client secret it was registered with. An account session can be opened only on a connection where this has been done. | help.ctrader.comchecked |
| cTrader Open API | messageProtoOARefreshTokenReq cTrader Open API | Exchanges a refresh token for a new access token for the granted trading account. | help.ctrader.comchecked |
| Deriv | messageping Deriv WebSocket API | Asks the server to answer pong. It tests that the connection is alive and is the usual way to keep an idle one open. | developers.deriv.comchecked |
| DXtrade APIs | messagePing DXtrade Push API | The client's answer to a PingRequest from the server. On receiving it the server extends the session token, so a client that only listens still has to send it. | demo.dx.tradechecked |
| eToro | messageAuthenticate eToro WebSocket API | Authenticates the WebSocket session with the user key and the API key, sent inside the message. It is needed before subscribing to the private topic, and public instrument topics do not need it. | api-portal.etoro.comchecked |
| MetaTrader 5 (Python package and MQL5) | functioninitialize() MetaTrader5 Python package | Connects the Python package to a MetaTrader 5 terminal on the same computer, starting the terminal if it is not running, and can log in to a trading account in the same call. | mql5.comchecked |
| MetaTrader 5 (Python package and MQL5) | functionlogin() MetaTrader5 Python package | Switches the connected terminal to a trading account, by account number, with the password and server optional. | mql5.comchecked |
| MetaTrader 5 (Python package and MQL5) | functionshutdown() MetaTrader5 Python package | Closes the connection that initialize() opened between the Python package and the terminal. | mql5.comchecked |
| Saxo OpenAPI | messageconnect Saxo OpenAPI streaming connection | Opens the streaming WebSocket. It is an HTTP GET that upgrades to a WebSocket, carrying a context id you choose and an access token. Data for every subscription made with that context id then arrives on this one connection. | developer.saxochecked |
None documented here yet
These APIs have endpoint records on this site, but none is assigned to this task. That describes this dataset. It is not a statement that the API lacks such a call.
- Deriv: none documented here yet
- eToro: none documented here yet
- OANDA: none documented here yet
- Saxo OpenAPI: none documented here yet
- Trading 212: none documented here yet
- MetaApi: none documented here yet
Brokers and platforms with no endpoint records at all are not listed above. The broker directory shows what is recorded for each.