cTrader APIAuthentication
For AI agents: this page is also available as Markdown at /docs/ctrader/authentication.md. The index of every docs page is /docs/llms.txt.
cTrader API Authentication
Every FxSocket API request is authenticated with a per-user API key, passed as an X-API-Key header, or as an api_key query parameter for clients (like WebSocket) that can't set headers. The key only works against your own accounts. The cTrader account itself is linked once with cTrader sign-in on the dashboard, so FxSocket holds a revocable grant from Spotware instead of your password.
X-API-Key: fxs_live_...Every request needs your fxsocket API key: copy it from the dashboard's API Key page. Keys are per-user and only work on your own accounts: the bridge checks the key for each account separately, so a valid key used against someone else's account_id still gets a 401. Your cTrader password never reaches FxSocket; the account is linked with cTrader sign-in.
{
"error": "UNAUTHORIZED",
"message": "This request needs a valid API key. Send it in the X-API-Key header, or as the api_key query parameter for WebSocket connections.",
"command_id": 0
}?api_key=fxs_live_...Alternative to the header, and the only method WebSocket clients can use. The key is the same in both cases. There is no Bearer / Authorization scheme.
A key you rotate on the dashboard reaches the cTrader bridge within about 30 seconds, without a restart; the old key stops working at the same moment.