# Capital.com API with Python Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade. This is the markdown version of https://openbrokerapi.com/guides/capital-com-api-python, written from the same records as that page. Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders. Capital.com publishes a REST API and a Postman collection, but no Python SDK of its own. That is fine: the API is plain enough that requests will do. The part that catches people is the setup. - Last reviewed: 2026-09-20 Unverified in part: carried over from an earlier version of this site. The links below are the sources it was written from, but its statements have not been re-read at source since the date shown, so check anything you rely on. ## What you need to know before you write a line Capital.com's own repositories cover Postman, Java samples and an MCP server. No Python package is published by the broker, so the honest answer for Python is the requests library against the REST API. Source: [GitHub: capital-com-sv/capital-api-postman](https://github.com/capital-com-sv/capital-api-postman) checked 18 Sep 2026 capitalcom-python on PyPI has had no release since 0.2.3 in December 2023. It may still work, but nobody is maintaining it, so read the code before you depend on it. Source: [PyPI: capitalcom-python](https://pypi.org/project/capitalcom-python/) checked 18 Sep 2026 POST /session with an X-CAP-API-KEY header plus your login credentials returns CST and X-SECURITY-TOKEN, which you send on every later call. The session expires after 10 minutes of inactivity. Source: [Capital.com Public API documentation](https://open-api.capital.com/) checked 18 Sep 2026 demo-api-capital.backend-capital.com for demo and api-capital.backend-capital.com for live. Point a script at the wrong one and the credentials simply will not work. Source: [Capital.com Public API documentation](https://open-api.capital.com/) checked 18 Sep 2026 10 requests a second per user; one request per 0.1 seconds when opening positions or creating orders; POST /session is capped at one request a second per API key; on demo, POST /positions and /workingorders are capped at 1,000 requests an hour. Exceeding any of them returns HTTP 429. Source: [Capital.com Public API documentation](https://open-api.capital.com/) checked 18 Sep 2026 The newest entry on Capital.com's changelog is 28 Nov 2023, adding demo balance top-up at POST /accounts/topUp. Code written against these docs is unlikely to be overtaken quickly. Source: [Capital.com Public API changelog](https://open-api.capital.com/) checked 19 Sep 2026 ## The code Illustrative and untested by us. It reads only: it opens no position. ``` # No official SDK. This is the whole of the login, with requests. # DEMO ONLY. Set the three values as environment variables, never in the file. import os import requests BASE = "https://demo-api-capital.backend-capital.com" # demo host, not live r = requests.post( BASE + "/api/v1/session", headers={"X-CAP-API-KEY": os.environ["CAPITAL_API_KEY"]}, json={ "identifier": os.environ["CAPITAL_IDENTIFIER"], "password": os.environ["CAPITAL_PASSWORD"], # the custom API password }, timeout=20, ) r.raise_for_status() # Both tokens come back in the response headers, not the body. auth = {"CST": r.headers["CST"], "X-SECURITY-TOKEN": r.headers["X-SECURITY-TOKEN"]} print(requests.get(BASE + "/api/v1/accounts", headers=auth, timeout=20).json()) ``` ## The setup mistakes that cost a day - Two factor authentication has to be on before a key can be generated at all. Settings, then API integrations, then generate a new key. - The custom API password you set when generating the key is not your login password. Capital.com's own help article names mixing the two as a common setup mistake. - The key is shown once. There is no way to read it back, so store it when it appears. - Key generation is itself limited to 100 attempts in 24 hours, so do not loop on a failing setup. Source: [Capital.com help: how to set up the MCP server](https://help.capitalccau.com/hc/en-us/articles/36672958169490-How-to-set-up-the-Capital-com-MCP-Server) checked 19 Sep 2026 We could not confirm it on any page we opened on this reading, so check it yourself before you rely on it. ## Where to go next - [Capital.com: key to first call](https://openbrokerapi.com/brokers/capital-com/quickstart)The step by step, including the 2FA and key generation - [The Capital.com API page](https://openbrokerapi.com/brokers/capital-com)Auth, limits, demo access and the MCP setup gotchas - [Every Capital.com endpoint we have mapped](https://openbrokerapi.com/brokers/capital-com/endpoints)Parameters, codes and a mock response for each - [Capital.com API error codes](https://openbrokerapi.com/errors/capital-com)What each one means and what to do about it ## More on the Capital.com API - [Capital.com API quickstart](https://openbrokerapi.com/brokers/capital-com/quickstart): From credentials to a first call on a demo account, step by step. - [Capital.com API error codes](https://openbrokerapi.com/errors/capital-com): 24 decoded, each with what it means, and the fix where the source gives one. - [Capital.com API endpoints](https://openbrokerapi.com/brokers/capital-com/endpoints): 36 documented, each with its method, path, parameters and source. - [Capital.com messages](https://openbrokerapi.com/brokers/capital-com/messages): 7 documented, each with its fields and source. - [Capital.com API page](https://openbrokerapi.com/brokers/capital-com): The full record: access, authentication, limits and the source for each. - [Get your Capital.com trade history into a spreadsheet](https://openbrokerapi.com/guides/capital-com-trade-history): Guide ## Licence and how to cite The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page. Cite as: Capital.com API with Python. Broker API Hub, https://openbrokerapi.com/guides/capital-com-api-python, newest check 2026-09-20. Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.