# MetaTrader 4 API Authentication

> Index of every docs page as Markdown: [llms.txt](https://fxsocket.com/docs/llms.txt). All pages in one file: [llms-full.txt](https://fxsocket.com/llms-full.txt).

Source: https://fxsocket.com/docs/mt4/authentication

Every FxSocket API request is authenticated with a per-user API key, passed as an X-API-Key header, or as an api_key query parameter for clients (like WebSocket) that can't set headers. There is no OAuth dance or Bearer scheme to manage, and your key only works against your own MetaTrader 4 accounts.

### Header X-API-Key: fxs_live_...

Every request needs your fxsocket API key, copy it from the dashboard's API Key page. Keys are per-user and only work on your own accounts: authentication is enforced by your own dedicated terminal, and a valid key used against someone else's account_id still gets a 401.

401 response:

```json
{
  "error": "UNAUTHORIZED",
  "message": "This request needs a valid API key. Send it in the X-API-Key header, or as the api_key query parameter for WebSocket connections.",
  "command_id": 0
}
```

### Query ?api_key=fxs_live_...

Alternative to the header, and the only method WebSocket clients can use. The key is the same in both cases. There is no Bearer / Authorization scheme.

Rotating your key from the dashboard propagates to your terminals within about 5 minutes. The terminal restarts briefly when the new key lands, so a short window of 5xx responses right after a rotation is normal.

## Related

- [Managing Accounts](https://fxsocket.com/docs/mt4/accounts.md)
- [Account Data](https://fxsocket.com/docs/mt4/account-data.md)
- [Errors & Rate Limits](https://fxsocket.com/docs/mt4/errors.md)