Broker API HubMenu

Staying logged in: session lifetimes compared

Every broker logs you out differently. IG v2 tokens last 12 hours between calls on IG's own FAQ, IG v3 tokens about a minute, Capital.com drops you after 10 idle minutes, Saxo rotates refresh tokens and IBKR wants a browser. Plan for it.

Independent and unofficialChecked For: Python hobbyists and anyone running a bot overnight

Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders.

Steps

  1. IG v2: 12 hours between calls, official

    The official figure is IG Labs' own FAQ: CST and X-SECURITY-TOKEN stay valid for 12 hours between calls. That is the number to design to. IG's own REST trading API guide gives a different figure: 6 hours at first, extended up to a maximum of 72 hours. Two IG pages disagree, so design to the shorter 6 hours if you want a margin. Either way, refresh on a 401 rather than trusting a clock.

    Unverifiedlabs.ig.com

  2. IG v3: about a minute, community only

    Version 3 logins return OAuth tokens that expire after about 1 minute and must be refreshed. That figure comes from the community trading-ig FAQ; we found no official IG figure for v3, so treat it as community sourced. The same FAQ advises sticking with v2 if you can.

    trading-ig.readthedocs.iochecked

  3. IG: re-log in once, then stop

    When a response contains client-token-invalid or oauth-token-invalid, log in again once and retry. If it fails again, stop and investigate rather than looping.

    raw.githubusercontent.comchecked

  4. Capital.com: 10 minutes idle

    A Capital.com session times out after 10 minutes of inactivity. Log in again when it does, but no more than once a second: POST /session is limited to 1 request per second per API key.

    open-api.capital.comchecked

  5. OANDA: no session to keep alive

    OANDA uses a personal access token sent as a Bearer header on every request, so there is no login session to expire.

    developer.oanda.comchecked

  6. Saxo: refresh tokens rotate

    Each Saxo refresh token is invalidated when you use it and replaced with a new one. Save the new one every time or your next refresh fails. Portal developer tokens last 24 hours.

    developer.saxochecked

  7. IBKR: the gateway needs a browser login

    Retail users log in to the Client Portal Gateway through a browser on the same machine. IBKR allows one brokerage session per username across all its platforms, so logging in on TWS or the mobile app can end your API session.

    interactivebrokers.comchecked

  8. IBKR: IBeam for headless re-auth

    IBKR's Web API page gives no clear procedure for staying authenticated. The community tool IBeam automates gateway re-authentication; it is not an IBKR product.

    github.comchecked

Sources

Sections