HTTP 401 in broker APIs: what it means, broker by broker
39 decoded error codes from 11 brokers and platforms return this status, and one general record gives the standard's meaning: 40 records on this page. The count is of records whose recorded HTTP status is 401. A search for the number 401 also finds records that only mention it in their code or meaning, so the error lookup can show more.
Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.
What the status means in general
HTTP 401 is Unauthorized. The request was not applied because it lacks valid authentication credentials for the resource. The standard says the reply must carry a WWW-Authenticate header, and that when credentials were sent, 401 means they were refused.
In trading API work this is nearly always a token or key problem: the token has expired, it was sent in the wrong header, or it belongs to the demo environment while the call went to live, or the reverse.
Check which environment the credential belongs to and how the API expects it to be sent. If sessions expire, log in again or refresh the token, then repeat the request. Never paste a credential into a forum post or a chat when asking for help.
The first paragraph is the standard's meaning in this site's words, with its source. The rest is this site's own explanation and describes no particular broker. HTTP 401 Unauthorized on its own page.
The status alone is only the category. The code or message in the body of the reply is what tells you the cause, and that differs from one API to the next.
The decoded errors that return it
In order of broker name, then code. Each row links to the full meaning and the fix.
Capital.com
| Code | Meaning, first sentence | Source |
|---|---|---|
| error.invalid.details | Invalid credentials on session creation. | github.comchecked |
Deriv
| Code | Meaning, first sentence | Source |
|---|---|---|
| Deriv-App-ID header is required for PAT tokens | A REST request authenticated with a personal access token was sent without the Deriv-App-ID header. | developers.deriv.comchecked |
DXtrade APIs
| Code | Meaning, first sentence | Source |
|---|---|---|
| 1 Authorization required | DXtrade errorCode 1, description "Authorization required" (the vendor's wording). | demo.dx.tradechecked |
| 3 Incorrect username or password | DXtrade errorCode 3, description "Incorrect username or password" (the vendor's wording). | demo.dx.tradechecked |
| 12 HMAC signature too old | DXtrade errorCode 12, description "HMAC signature too old" (the vendor's wording). | demo.dx.tradechecked |
| 13 HMAC signature mismatch | DXtrade errorCode 13, description "HMAC signature mismatch" (the vendor's wording). | demo.dx.tradechecked |
| 401 Unauthorized | DXtrade REST API: The client is not authorised in the system. | demo.dx.tradechecked |
eToro
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 401 | Authentication is missing or invalid: the key pair or the bearer token did not identify a caller eToro accepts. | api-portal.etoro.comchecked |
IG
| Code | Meaning, first sentence | Source |
|---|---|---|
| authentication.failure.not-a-client-account | The account used to log in is not a valid client account. | labs.ig.comchecked |
| error.public-api.failure.kyc.required | The account is not allowed to log in to the API. | labs.ig.comchecked |
| error.public-api.failure.missing.credentials | The request did not carry all of the security credentials the endpoint needs. | labs.ig.comchecked |
| error.public-api.failure.pending.agreements.required | The account is not allowed to log in to the public API. | labs.ig.comchecked |
| error.public-api.failure.preferred.account.disabled | The user's preferred account is disabled. | labs.ig.comchecked |
| error.public-api.failure.preferred.account.not.set | The user has not set a preferred account. | labs.ig.comchecked |
| error.security.account-access-denied | The account has been denied login privileges. | labs.ig.comchecked |
| error.security.account-migrated | The account has been migrated to IG's client and account model. | labs.ig.comchecked |
| error.security.account-not-yet-activated | The account has not been activated yet. | labs.ig.comchecked |
| error.security.account-suspended | The account has been suspended. | labs.ig.comchecked |
| error.security.account-token-invalid | The endpoint needs an account token and the one sent was not valid. | labs.ig.comchecked |
| error.security.account-token-missing | The endpoint needs an account token and none was sent. | labs.ig.comchecked |
| error.security.all-accounts-pending | All of the client's accounts are in a pending state. | labs.ig.comchecked |
| error.security.all-accounts-suspended | All of the client's accounts have been suspended. | labs.ig.comchecked |
| error.security.client-suspended | The client has been suspended from using the platform. | labs.ig.comchecked |
| error.security.client-token-invalid | The endpoint needs a client token and the one sent was not valid. | labs.ig.comchecked |
| error.security.client-token-missing | The endpoint needs a client token and none was sent. | labs.ig.comchecked |
| error.security.generic | An unexpected error happened on IG's side and the request could not proceed. | labs.ig.comchecked |
| error.security.invalid-application | The user agent string sent with the request is not valid. | labs.ig.comchecked |
| error.security.invalid-details | The credentials used to log in are not valid, so the login is rejected. | labs.ig.comchecked |
| error.security.invalid-website | The site the account belongs to is not accessible through the API services. | labs.ig.comchecked |
| error.security.oauth-token-invalid | The OAuth access token is not valid. | labs.ig.comchecked |
| error.security.too-many-failed-attempts | The maximum number of failed login attempts has been reached. | labs.ig.comchecked |
Interactive Brokers
| Code | Meaning, first sentence | Source |
|---|---|---|
| 401 Unauthorized | On the Web API, the reference for submitting an order lists 401 Unauthorized and describes it as a missing, invalid or unparseable Authorization token. | interactivebrokers.comchecked |
Match-Trader Platform API
| Code | Meaning, first sentence | Source |
|---|---|---|
| 401 Unauthorized | In the Match-Trader Platform API documentation, the example of a 401 response has the title "Unauthorized" and the detail "Authorization information is missing or invalid." (the vendor's wording), with the status, the request path and a timestamp. | app.theneo.iochecked |
OANDA
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 401 (invalid or missing token) | The access token is invalid or missing. | developer.oanda.comchecked |
| Insufficient authorization to perform request. | Usually the host (practice or live) does not match your token or account. | help.oanda.comchecked |
| The provided request was forbidden. | The account ID given is not valid. | developer.oanda.comchecked |
Saxo OpenAPI
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 401 | Saxo refused the request because the Authorization header was missing or the security token in it was not valid. | developer.saxochecked |
TradeLocker API
| Code | Meaning, first sentence | Source |
|---|---|---|
| 401 Unauthorized | TradeLocker lists 401 with the description "Unauthorized" as a response of its /trade routes, including placing, modifying and cancelling orders. | public-api.tradelocker.comchecked |
Trading 212
| Code | Meaning, first sentence | Source |
|---|---|---|
| HTTP 401 | Trading 212 did not accept the credentials on the request. | docs.trading212.comchecked |
Brokers and platforms not listed here have no decoded error recorded with this status. That describes this dataset, not their APIs.