Broker Trading APIs: What a Retail Account Actually Gets

Search for a broker trading API and the results are almost all rankings. They compare brokers on deposits, instrument counts and spreads, and they describe REST, WebSocket and FIX as though every account came with a choice between them.

For most retail forex accounts none of that is true. What your account exposes to an outside program depends on which platform your broker runs, and the two most common answers are not variations on one idea. They are different architectures with different security consequences, and the one used by more retail traders than any other is not a network API at all.

What a Trading API Is, and What Most Retail Accounts Do Not Have

An application programming interface is simply a defined way for one program to ask another program to do something. In trading that usually means a program of yours asking for prices, or asking for an order to be placed, without a human clicking anything.

The rankings treat that as one product with several protocol flavours. It is more useful to ask a different question: where does the program you write actually connect to?

There are two answers in common use, and they are not close relatives. In one, your program connects to trading software installed on your own machine, and that software keeps its existing connection to the broker. In the other, your program connects to the broker’s servers directly, over the internet, holding a credential of its own.

Almost everything that matters afterwards follows from that split: whether a machine has to stay switched on, whether a credential exists that can be taken away, and what an attacker gets if your code is compromised.

The Terminal Route: Why the MetaTrader Python Package Is Not a Network API

MetaQuotes publishes a Python package for MetaTrader 5, installed with pip, and it is the route most retail traders reach for. Its documentation is specific about how it works, and the detail is easy to skim past.

The package does not call a web service. It exchanges data with the MetaTrader 5 terminal on the same computer, using communication between processes rather than a network request. There is no hostname to connect to, no endpoint to call and no API key to issue, because nothing is being authenticated across a network in the first place.

That shows in the first function you call. Initialising the connection takes the file path of the terminal executable, and if you do not supply one the package goes looking for the installed program itself. You can pass an account number, a password and a server name, but you do not have to: MetaQuotes documents that where no password is given, the one already saved in the terminal for that account is used automatically.

Read that again, because it is the sentence with consequences. Your script does not hold a credential you granted it. It borrows the credential the terminal is already holding.

What the package can do is broad. Its documented functions cover account and terminal information, symbol lists and individual symbol data, the last tick, market depth subscriptions, historical bars and ticks, pending orders, margin and profit calculations, an order check, order submission, open positions, and order and deal history.

That is a full trading surface. It just reaches it through a program on your desk rather than through a server, and it needs both the terminal and the machine running to do any of it. If you are weighing the platforms themselves, the terminal differences are set out in what separates MT4 from MT5.

The Server Route: What an OAuth Token Actually Grants

cTrader takes the opposite approach. Spotware, which builds the platform, publishes an Open API that anyone holding a cTrader ID can use to build an application talking to the cTrader backend, and its documentation states the service is available to anyone registered with a broker offering the platform.

Messages travel as JSON or as Google Protocol Buffers, so the language you write in is your own choice. Who builds cTrader and what the broker controls is covered in what cTrader is and who builds it.

The part worth understanding is the authorisation, because it is where this model differs most.

Access runs on OAuth 2.0. The user is sent to a page where they grant your application permission, and the application receives a short-lived authorisation code, which Spotware documents as expiring after one minute. That code is exchanged for an access token, documented with a lifetime of 2,628,000 seconds, which is roughly thirty days. When it expires a refresh token issues a new one, and the refresh token itself carries no expiry.

There is a second identity in play as well. Before an application can act on any account it authenticates itself, sending its own client identifier and secret, and only then asks which trading accounts the user’s token covers.

So there are two separate things here: the application, which the broker’s platform knows about, and the permission a specific user has given it. Neither of them is the account password.

Two Security Models, and What Each One Puts at Risk

Put the two side by side and the difference stops being a technical footnote.

The revocation row is the one to weigh. If a script on the terminal route is compromised, the attacker has whatever the terminal has, and the only way to cut that off is to change the account password, which stops every other tool at the same time. On the server route the permission is a separate object and can be withdrawn on its own.

What Happens to an Open Position When Your Code Stops

This question is missing from every ranking, and it has a clear answer.

An open position lives on the broker’s server. It is a record there, not in your program, so a crashed script, a closed terminal or a dead internet connection does not close it. It also does not close a stop or a take-profit that you attached to the position, because those were sent to the server too.

What does disappear is anything that existed only inside your code. A rule that would have closed the trade at a certain time, a level your script was watching in order to move a stop, an exit that had not yet been submitted as an order: none of these exist anywhere except in the running program. When the program stops, they stop.

That is the practical argument for putting protective orders on the server rather than in your logic, and it applies identically to both routes.

Keeping the whole setup running without depending on your own machine is a separate subject, covered in keeping a strategy running around the clock, and this page does not repeat it. Where several automated programs share one account, the interference problem is set out in running several expert advisors at once.

Who the Algorithmic Trading Rules Actually Bind

Two of the pages reviewed for this article carry a section on regulation. Neither names a regulator, a rule or a person the rule applies to. The rulebook is public, so the question can be settled rather than gestured at.

In the United Kingdom the relevant chapter is MAR 7A of the FCA Handbook. Its application rule names two kinds of firm: a UK MiFID investment firm, and a third country investment firm, provided it maintains an establishment in the United Kingdom. Three activities are then caught: algorithmic trading; the service of giving a client direct electronic access to a trading venue; and the service of acting as general clearing member to another person.

Every obligation that follows is written to the firm. The systems and controls rule requires a firm to keep its trading systems resilient and adequately sized, subject to appropriate thresholds and limits, unable to send erroneous orders or otherwise contribute to a disorderly market, and incapable of being used in breach of the market abuse regime or of a trading venue’s own rules.

A retail client running a script at home is not the addressee of any of that. Nor is a retail spot forex or contracts-for-difference account direct electronic access to a trading venue, because the orders go to the broker rather than to an exchange.

None of which means a retail trader has no responsibilities. They are simply contractual rather than regulatory: an order sent by your program is your order, and the client agreement, not the Handbook, is where the consequences of one sent in error are written down.

The Numbers Every Comparison Page States and No Source Supports

The rankings reviewed for this page share one feature. Their figures come from nowhere.

Minimum deposits, tradeable symbol counts, average spreads, proprietary broker scores, request limits per minute, and the share of market volume said to be automated are all stated flatly, with no citation to the broker, the exchange or any regulator. One page gives three different instrument counts for the same broker in three places without reconciling them.

That is why no figure of that kind appears here. Under the evidence rule this site works to, a figure that cannot be traced to an official source does not go on the page at all, and a number repeated by several competitors is not evidence of anything except that they read each other.

The two figures this page does state, the one-minute authorisation code and the thirty-day access token, are published by the company that operates the platform and were read at its documentation on the date given below. If your broker documents something different, the broker is the authority for its own service.

Who This Page Is Not For

Anyone expecting programmatic access to improve results. It changes how an instruction is delivered, not whether the instruction was any good, and a strategy that loses money by hand loses it faster automatically.

Anyone who has not tested the logic. Sending live orders from code that has never been examined against historical data is an expensive way to discover an error, and the ground rules are in testing a strategy before it trades money.

Anyone choosing a broker on the strength of an API listing alone. The interface is one property of an account among many, and it says nothing about pricing, execution or which regulated entity holds the money.

Frequently Asked Questions