Security

Connecting an account means trusting us with its password. This page says what we do with it, and what remains your responsibility.

Broker passwords

Sent once, over TLS, when you connect the account.
Encrypted immediately, with a key unique to that account. An encrypted password cannot be moved onto another account and decrypted there.
Never returned by any endpoint, never shown in the console, and never written to a log or an error message.
Used only to log the account in at its broker — or to re-store it when you move the account to a corrected server — and every use is recorded in an audit trail.
Erased when you disconnect the account. The account's trading history stays; the password does not.

Send the trading password. An investor password logs in but cannot trade.

A key is shown once, when it is created, and we never store the key itself — nobody, including us, can read it back.
Keys are scoped: give each integration only what it needs, such as trading:reduce for a risk tool that must be able to close but never open.
Live and test keys are labelled (fx_live_…, fx_test_…), so each configuration is easy to tell apart. Both reach real brokers — test with demo accounts.
Revoking a key takes effect on its next request.

Keys are server-to-server credentials. Keep them out of browsers, mobile apps and source control. See Authentication.

The session cookie is moving to a __Host- cookie, which only fxapis.com itself can set or read, never a subdomain. It is rolling out now; the current cookie name is accepted until the change is complete.
A session lasts seven days and ends after a day unused. The staff console asks staff to sign in again every 12 hours and after 30 minutes away.
Repeated wrong passwords bring a quick human check, then a 15-minute pause for the account, with an email to its owner.
Making a key that can move money or accounts, widening a key to such a scope or changing limits on a key that already has them, team changes and plan changes ask you to confirm it's you if you have not in the last two hours. Staff keep a ten-minute window in the staff console.
Every sign-in, failed sign-in, sign-out, password change and two-factor change is in your workspace's audit log. A sign-in from a browser not seen on that network in 30 days is emailed to you.

Every workspace is isolated. Another workspace's account, order or key is simply not found — we do not even confirm that it exists.
All traffic between you and fxapis is encrypted: the API is only reachable over HTTPS. Credentials pass between our services over mutual TLS on a private network.
Everything that changes an account is audited: connecting, disconnecting, every order, every key issued or revoked.
Your trading history is kept for the life of the account, because it is what a dispute or an audit is settled with.

Issue narrow keys and rotate them. A key with accounts:write can disconnect accounts; a key with trading:execute can open positions.
Use a dedicated MT5 account for automated trading where you can, and consider turning on your broker's own protections.
Protect your console sign-in. Members of your workspace can manage its keys according to their role. Turn on two-factor sign-in (an authenticator app, with backup codes) under Security in the console, and check the list of browsers you are signed in on there from time to time.

Email [email protected]. We acknowledge within one business day. Please do not disclose publicly until we have had a chance to fix it.