Skip to main content

Log a client in from your CRM

A common back-office need: a user clicks "Open terminal" in your CRM and lands in the trading platform already signed in. You drive this from your backend with the credentials you set when you provisioned the account.

The flow​

  1. Provision the account once and keep its user_password (see Provisioning clients).
  2. Authenticate it from your backend to mint a fresh session:
curl --request POST \
  --url "https://api.onlytradeplatform.com/auth/v1/oauth2/login?remember_me=true" \
  --header "Authorization: Basic $(printf '26100016:Str0ng!Pass' | base64)"

The response carries access_token, refresh_token, and session_id.

  1. Hand the session to the terminal. Deep-link the user into https://terminal.onlytradeplatform.com with the session your backend just minted, so they arrive authenticated. The WebSocket stream binds to the session_id, so the live feed is scoped to that account.

Read-only access​

To give a viewer (an investor, an affiliate, a risk desk) live visibility without trade permissions, authenticate with the account's investor_password instead of user_password. The session's scope becomes Investor — every order/close/modify call is rejected server-side and the terminal hides the trade controls.

On true one-click SSO

Today the CRM login is a single backend call (authenticate → hand off the session). A dedicated one-call act-as / SSO deep-link endpoint — where your admin token mints a short-lived terminal session for a managed account without holding its password — is on the roadmap. Until then, keep the account credentials in your backend and use the flow above.