# cTrader API Authentication

> Index of every docs page as Markdown: [llms.txt](https://fxsocket.com/docs/llms.txt). All pages in one file: [llms-full.txt](https://fxsocket.com/llms-full.txt).

Source: https://fxsocket.com/docs/ctrader/authentication

Every FxSocket API request is authenticated with a per-user API key, passed as an X-API-Key header, or as an api_key query parameter for clients (like WebSocket) that can't set headers. The key only works against your own accounts. The cTrader account itself is linked once with cTrader sign-in on the dashboard, so FxSocket holds a revocable grant from Spotware instead of your password.

### Header X-API-Key: fxs_live_...

Every request needs your fxsocket API key: copy it from the dashboard's API Key page. Keys are per-user and only work on your own accounts: the bridge checks the key for each account separately, so a valid key used against someone else's account_id still gets a 401. Your cTrader password never reaches FxSocket; the account is linked with cTrader sign-in.

401 response:

```json
{
  "error": "UNAUTHORIZED",
  "message": "This request needs a valid API key. Send it in the X-API-Key header, or as the api_key query parameter for WebSocket connections.",
  "command_id": 0
}
```

### Query ?api_key=fxs_live_...

Alternative to the header, and the only method WebSocket clients can use. The key is the same in both cases. There is no Bearer / Authorization scheme.

A key you rotate on the dashboard reaches the cTrader bridge within about 30 seconds, without a restart; the old key stops working at the same moment.

## Related

- [Managing accounts](https://fxsocket.com/docs/ctrader/accounts.md)
- [Account data](https://fxsocket.com/docs/ctrader/account-data.md)
- [Errors & rate limits](https://fxsocket.com/docs/ctrader/errors.md)