Capital.com API with Python

What you need to know before you write a line

Capital.com's own repositories cover Postman, Java samples and an MCP server. No Python package is published by the broker, so the honest answer for Python is the requests library against the REST API.

Source: GitHub: capital-com-sv/capital-api-postman checked 18 Sep 2026

capitalcom-python on PyPI has had no release since 0.2.3 in December 2023. It may still work, but nobody is maintaining it, so read the code before you depend on it.

Source: PyPI: capitalcom-python checked 18 Sep 2026

POST /session with an X-CAP-API-KEY header plus your login credentials returns CST and X-SECURITY-TOKEN, which you send on every later call. The session expires after 10 minutes of inactivity.

Source: Capital.com Public API documentation checked 18 Sep 2026

demo-api-capital.backend-capital.com for demo and api-capital.backend-capital.com for live. Point a script at the wrong one and the credentials simply will not work.

Source: Capital.com Public API documentation checked 18 Sep 2026

10 requests a second per user; one request per 0.1 seconds when opening positions or creating orders; POST /session is capped at one request a second per API key; on demo, POST /positions and /workingorders are capped at 1,000 requests an hour. Exceeding any of them returns HTTP 429.

Source: Capital.com Public API documentation checked 18 Sep 2026

The newest entry on Capital.com's changelog is 28 Nov 2023, adding demo balance top-up at POST /accounts/topUp. Code written against these docs is unlikely to be overtaken quickly.

Source: Capital.com Public API changelog checked 19 Sep 2026

The code

Illustrative and untested by us. It reads only: it opens no position.

# No official SDK. This is the whole of the login, with requests.
# DEMO ONLY. Set the three values as environment variables, never in the file.
import os
import requests

BASE = "https://demo-api-capital.backend-capital.com"  # demo host, not live

r = requests.post(
    BASE + "/api/v1/session",
    headers={"X-CAP-API-KEY": os.environ["CAPITAL_API_KEY"]},
    json={
        "identifier": os.environ["CAPITAL_IDENTIFIER"],
        "password": os.environ["CAPITAL_PASSWORD"],  # the custom API password
    },
    timeout=20,
)
r.raise_for_status()

# Both tokens come back in the response headers, not the body.
auth = {"CST": r.headers["CST"], "X-SECURITY-TOKEN": r.headers["X-SECURITY-TOKEN"]}
print(requests.get(BASE + "/api/v1/accounts", headers=auth, timeout=20).json())

The setup mistakes that cost a day

• Two factor authentication has to be on before a key can be generated at all. Settings, then API integrations, then generate a new key.
• The custom API password you set when generating the key is not your login password. Capital.com's own help article names mixing the two as a common setup mistake.
• The key is shown once. There is no way to read it back, so store it when it appears.
• Key generation is itself limited to 100 attempts in 24 hours, so do not loop on a failing setup.

Source: Capital.com help: how to set up the MCP server checked 19 Sep 2026 We could not confirm it on any page we opened on this reading, so check it yourself before you rely on it.

Where to go next

• Capital.com: key to first callThe step by step, including the 2FA and key generation
• The Capital.com API pageAuth, limits, demo access and the MCP setup gotchas
• Every Capital.com endpoint we have mappedParameters, codes and a mock response for each
• Capital.com API error codesWhat each one means and what to do about it