Authentication

The Trade API authenticates a person with a password (the trader login). Your back-office integration should instead authenticate a machine with a client_credentials key, so no human password lives in your servers.

1. Mint a client secret

Signed in as the account that will own the integration (typically your admin/dealer account), generate a secret:

curl --request POST \
  --url https://api.onlytradeplatform.com/api/v1/accounts/me/client-secret \
  --header "Authorization: Bearer $ADMIN_TOKEN"

The response returns a client_secret once — store it securely, it is not retrievable again. Your client_id is the account id.

Revoke it any time:

curl --request DELETE \
  --url https://api.onlytradeplatform.com/api/v1/accounts/me/client-secret \
  --header "Authorization: Bearer $ADMIN_TOKEN"

2. Exchange it for an access token

Use the client_credentials grant with HTTP Basic auth (client_id:client_secret):

curl --request POST \
  --url "https://api.onlytradeplatform.com/auth/v1/oauth2/token?grant_type=client_credentials" \
  --header "Authorization: Basic $(printf '26100001:YOUR_CLIENT_SECRET' | base64)"

The response is the standard login envelope:

{
  "data": {
    "account_id": 26100001,
    "access_token": "…",
    "refresh_token": "…",
    "session_id": "…",
    "expires_in": 3600,
    "scope": "Admin"
  }
}

Send access_token as Authorization: Bearer … on every Broker API call. Refresh with the refresh token flow before it expires.

Scopes

The token's scope mirrors the owning account's role and gates what it can do:

Scope	Back-office capability
Admin	full provisioning, all groups, money, config
Dealer	manage the sub-groups and accounts they own
Trader / Investor	trader-facing only — not for back-office use

Keep keys server-side

The client_secret is a bearer credential for your whole book. Never ship it to a browser or mobile app — call the Broker API only from your backend.