Skip to main content

Authentication

OnlyTrade uses OAuth2 bearer tokens. You log in with HTTP Basic credentials (the numeric account ID + password), receive an access_token and a refresh_token, and send the access token as a Bearer header on every subsequent request.

Authorization: Bearer <access_token>

Log in​

POST /auth/v1/oauth2/login?remember_me=true

Headers

Authorization: Basic base64(<account_id>:<password>)

remember_me=true issues a long-lived refresh token; omit it for a session-length token.

Response data

{
  "account_id": 26100003,
  "access_token": "3d4d16824096e9c0...",
  "refresh_token": "9f2b71c55a30e1d4...",
  "expires_in": 7200,
  "session_id": "f6a1c2d3-...",
  "scope": "Trader"
}

scope is the role attached to the credentials — Trader, Investor (read-only investor password), Dealer, Admin, API_Trader, or API_Admin.

curl -X POST "https://api.onlytradeplatform.com/auth/v1/oauth2/login?remember_me=true" \
  -H "Authorization: Basic $(printf '26100003:MyPassword' | base64)"

Errors: 401 incorrect username or password, 401 the account has been deactivated (pending / rejected), 401 this trial account has expired.

Refresh a token​

Exchange the refresh token for fresh tokens. This works even after the access token has expired — it's how clients survive restarts.

POST /auth/v1/oauth2/refresh/token?remember_me=true
{ "refresh_token": "9f2b71c55a30e1d4..." }

The response has the same shape as login (new access_token, refresh_token, session_id).

Log out​

Ends the current session and revokes its tokens.

DELETE /auth/v1/oauth2/logout
Authorization: Bearer <access_token>

Notes​

  • Multi-device logins are allowed — each device gets its own session_id and token pair.
  • The session_id is also what the WebSocket handshake uses to authenticate.
  • Tokens are account-scoped: a Trader token only reaches /accounts/me resources; Admin / API_Admin tokens can manage every account, group and symbol. Permissions are enforced per endpoint.