# cTrader ProtoOAApplicationAuthReq Independent and unofficial. Not affiliated with or endorsed by any broker or platform named here. Educational only: nothing here is advice, and nothing here recommends a broker or a trade. This is the markdown version of https://openbrokerapi.com/platforms/ctrader/messages/protooaapplicationauthreq, written from the same records as that page. Risk warning: CFDs and spread bets are complex instruments and come with a high risk of losing money rapidly due to leverage. You can lose money on these products, and each provider publishes its own loss figure under FCA rules. You should consider whether you understand how they work and whether you can afford to take the high risk of losing your money. Automated and API trading can amplify losses through bugs, connectivity failures and runaway orders. Authorises the application on a newly opened connection, with the client id and client secret it was registered with. An account session can be opened only on a connection where this has been done. - Message: `ProtoOAApplicationAuthReq` - Interface: cTrader Open API - Group: Authorisation - Status: verified. Source: [help.ctrader.com](https://help.ctrader.com/open-api/messages/#protooaapplicationauthreq), checked 2026-10-12. - The definition file it was checked against: https://github.com/spotware/openapi-proto-messages/blob/main/OpenApiMessages.proto This is a message of the cTrader Open API, not an HTTP endpoint. It has no method and no path: it is sent over an open TCP or WebSocket connection, as Protocol Buffers or as JSON. It is in no OpenAPI file on this site and the request builder does not list it. ## The message - Name: `ProtoOAApplicationAuthReq` - Direction: Request, sent by the client - Payload type: `PROTO_OA_APPLICATION_AUTH_REQ`, number `2100`. This number is what identifies the message on the wire. - Answered by: [ProtoOAApplicationAuthRes](https://openbrokerapi.com/platforms/ctrader/messages/protooaapplicationauthres) ## Fields - `payloadType` (type ProtoOAPayloadType, optional): Identifies the message. Its default in the definition is PROTO_OA_APPLICATION_AUTH_REQ, which is number 2100. - `clientId` (type string, required): The client id issued when the application was registered. - `clientSecret` (type string, required): The client secret issued when the application was registered. A credential: keep it out of source code. ## Sample Written by this site from the payload type and fields recorded on this page. It has not been run against a terminal, a server or an account, and the values in it are placeholders. No credential is typed into it: where a field holds one, the placeholder says where it comes from. Nothing is entered on this site. The three outer keys, clientMsgId, payloadType and payload, are the ones Spotware's page on sending and receiving JSON gives. The sample holds the message's required and repeated fields and leaves the optional ones out. Status: verified. Source: [help.ctrader.com](https://help.ctrader.com/open-api/sending-receiving-json/), checked 2026-10-12. ```json { "clientMsgId": "msg-1", "payloadType": 2100, "payload": { "clientId": "", "clientSecret": "" } } ``` ## Limits that apply at cTrader Open API - Requests a second, not historical data: 50 requests per second - Scope: Per connection, requests that are not for historical data - Status: verified. Source: [help.ctrader.com](https://help.ctrader.com/open-api/), checked 2026-10-12. - Note: Historical data requests have their own lower limit, held in a separate record. - Requests a second, historical data: 5 requests per second - Scope: Per connection, historical data requests only - Status: verified. Source: [help.ctrader.com](https://help.ctrader.com/open-api/), checked 2026-10-12. ## Related cTrader messages: Authorisation - [ProtoOAAccountAuthReq](https://openbrokerapi.com/platforms/ctrader/messages/protooaaccountauthreq): Opens a session for one trading account on a connection where the application is already authorised, using the access token granted for that account. - [ProtoOAAccountAuthRes](https://openbrokerapi.com/platforms/ctrader/messages/protooaaccountauthres): Confirms that the session for the trading account is open, naming the account. - [ProtoOAAccountLogoutReq](https://openbrokerapi.com/platforms/ctrader/messages/protooaaccountlogoutreq): Asks to end the session of one trading account on this connection. - [ProtoOAAccountLogoutRes](https://openbrokerapi.com/platforms/ctrader/messages/protooaaccountlogoutres): Acknowledges the logout request. The definition says the logout itself is complete only when ProtoOAAccountDisconnectEvent arrives. - [ProtoOAApplicationAuthRes](https://openbrokerapi.com/platforms/ctrader/messages/protooaapplicationauthres): Confirms that the application is authorised on this connection. It carries nothing beyond its payload type. - [ProtoOAGetAccountListByAccessTokenReq](https://openbrokerapi.com/platforms/ctrader/messages/protooagetaccountlistbyaccesstokenreq): Asks which trading accounts an access token was granted for. - [ProtoOAGetAccountListByAccessTokenRes](https://openbrokerapi.com/platforms/ctrader/messages/protooagetaccountlistbyaccesstokenres): Lists the trading accounts the access token covers, with the scope of permission the token carries. - [ProtoOARefreshTokenReq](https://openbrokerapi.com/platforms/ctrader/messages/protooarefreshtokenreq): Exchanges a refresh token for a new access token for the granted trading account. - [ProtoOARefreshTokenRes](https://openbrokerapi.com/platforms/ctrader/messages/protooarefreshtokenres): Returns the new access token, how long it lasts and a new refresh token. ## More on cTrader - [All cTrader messages](https://openbrokerapi.com/platforms/ctrader/messages): 49 documented here, grouped by what they do. - [Log in and keep a session: the call at each API](https://openbrokerapi.com/endpoints/session): The same job at every broker and platform API recorded here, HTTP or not. - [cTrader API quickstart](https://openbrokerapi.com/platforms/ctrader/quickstart) - [All cTrader error codes](https://openbrokerapi.com/errors/ctrader) - [cTrader API page](https://openbrokerapi.com/platforms/ctrader): The full record: access, authentication, limits and the source for each. ## Licence and how to cite The records behind this page are all rights reserved. This file is the page itself, at its own address, in another format. It is not part of the CC BY 4.0 downloads listed at https://openbrokerapi.com/data. Quote from it with a link to the page. Cite as: cTrader ProtoOAApplicationAuthReq. Broker API Hub, https://openbrokerapi.com/platforms/ctrader/messages/protooaapplicationauthreq, newest check 2026-10-12. Where you rely on a single figure, cite the source and the checked date printed beside it as well. Where this page and a broker's own documentation differ, the documentation wins.