# Staying logged in: session lifetimes compared Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade. This is the markdown version of https://openbrokerapi.com/guides/staying-logged-in, written from the same records as that page. Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders. Every broker logs you out differently. IG v2 tokens last 12 hours between calls on IG's own FAQ, IG v3 tokens about a minute, Capital.com drops you after 10 idle minutes, Saxo rotates refresh tokens and IBKR wants a browser. Plan for it. - Checked: 2026-09-19 - For: Python hobbyists and anyone running a bot overnight ## Steps ### 1. IG v2: 12 hours between calls, official The official figure is IG Labs' own FAQ: CST and X-SECURITY-TOKEN stay valid for 12 hours between calls. That is the number to design to. IG's own REST trading API guide gives a different figure: 6 hours at first, extended up to a maximum of 72 hours. Two IG pages disagree, so design to the shorter 6 hours if you want a margin. Either way, refresh on a 401 rather than trusting a clock. Status: unverified. Source: [labs.ig.com](https://labs.ig.com/faq.html), no checked date recorded. ### 2. IG v3: about a minute, community only Version 3 logins return OAuth tokens that expire after about 1 minute and must be refreshed. That figure comes from the community trading-ig FAQ; we found no official IG figure for v3, so treat it as community sourced. The same FAQ advises sticking with v2 if you can. Status: verified. Source: [trading-ig.readthedocs.io](https://trading-ig.readthedocs.io/en/latest/faq.html), checked 2026-09-19. ### 3. IG: re-log in once, then stop When a response contains client-token-invalid or oauth-token-invalid, log in again once and retry. If it fails again, stop and investigate rather than looping. Status: verified. Source: [raw.githubusercontent.com](https://raw.githubusercontent.com/ig-python/trading-ig/master/trading_ig/utils.py), checked 2026-09-19. ### 4. Capital.com: 10 minutes idle A Capital.com session times out after 10 minutes of inactivity. Log in again when it does, but no more than once a second: POST /session is limited to 1 request per second per API key. Status: verified. Source: [open-api.capital.com](https://open-api.capital.com/), checked 2026-09-19. ### 5. OANDA: no session to keep alive OANDA uses a personal access token sent as a Bearer header on every request, so there is no login session to expire. Status: verified. Source: [developer.oanda.com](https://developer.oanda.com/rest-live-v20/introduction/), checked 2026-09-19. ### 6. Saxo: refresh tokens rotate Each Saxo refresh token is invalidated when you use it and replaced with a new one. Save the new one every time or your next refresh fails. Portal developer tokens last 24 hours. Status: verified. Source: [developer.saxo](https://www.developer.saxo/openapi/learn/security), checked 2026-09-19. ### 7. IBKR: the gateway needs a browser login Retail users log in to the Client Portal Gateway through a browser on the same machine. IBKR allows one brokerage session per username across all its platforms, so logging in on TWS or the mobile app can end your API session. Status: verified. Source: [interactivebrokers.com](https://www.interactivebrokers.com/docs/web-api/authentication/cpgw/limitations-of-the-client-portal-gateway), checked 2026-09-19. ### 8. IBKR: IBeam for headless re-auth IBKR's Web API page gives no clear procedure for staying authenticated. The community tool IBeam automates gateway re-authentication; it is not an IBKR product. Status: verified. Source: [github.com](https://github.com/Voyz/ibeam), checked 2026-09-19. ## Sources - Status: verified. Source: [IG Labs FAQ](https://labs.ig.com/faq.html), checked 2026-10-12. - Status: verified. Source: [trading-ig FAQ (community)](https://trading-ig.readthedocs.io/en/latest/faq.html), checked 2026-09-19. - Status: verified. Source: [trading-ig utils.py (community)](https://raw.githubusercontent.com/ig-python/trading-ig/master/trading_ig/utils.py), checked 2026-09-19. - Status: verified. Source: [Capital.com Public API](https://open-api.capital.com/), checked 2026-09-19. - Status: verified. Source: [OANDA v20 introduction](https://developer.oanda.com/rest-live-v20/introduction/), checked 2026-09-19. - Status: verified. Source: [Saxo OpenAPI: security](https://www.developer.saxo/openapi/learn/security), checked 2026-09-19. - Status: verified. Source: [IBKR Web API documentation, limitations of the Client Portal Gateway](https://www.interactivebrokers.com/docs/web-api/authentication/cpgw/limitations-of-the-client-portal-gateway), checked 2026-10-12. - Status: verified. Source: [IBeam (community)](https://github.com/Voyz/ibeam), checked 2026-09-19. - Status: verified. Source: [IBKR Web API documentation, managing multiple sessions](https://www.interactivebrokers.com/docs/web-api/authentication/multiple-sessions), checked 2026-10-12. ## Related pages - [Getting started with API trading](https://openbrokerapi.com/guides/getting-started-with-api-trading): What an API is, what you need and how to make a first call safely. - [All guides](https://openbrokerapi.com/guides): Step by step guides, each step with the page it was read on. - [Brokers](https://openbrokerapi.com/brokers): The record for each broker: access, limits, endpoints and error codes. - [Platform APIs](https://openbrokerapi.com/platforms): APIs that belong to trading software offered by many brokers. - [Error codes](https://openbrokerapi.com/errors): What each error means, and the fix where the source gives one. - [Compare two APIs](https://openbrokerapi.com/compare): The same fields from two records, side by side. - [Learn to code](https://openbrokerapi.com/learn): A learning track from a first script to a demo account call. ## Licence and how to cite The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page. Cite as: Staying logged in: session lifetimes compared. Broker API Hub, https://openbrokerapi.com/guides/staying-logged-in, newest check 2026-09-19. Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.