Security

Connecting an account means trusting us with its password. This page says what we do with it, and what remains your responsibility.

Broker passwordsCopy Anchor Link

• Sent once, over TLS, when you connect the account.
• Encrypted immediately, with a key unique to that account. An encrypted password cannot be moved onto another account and decrypted there.
• Never returned by any endpoint, never shown in the console, and never written to a log or an error message.
• Used only to log the account in at its broker — or to re-store it when you move the account to a corrected server — and every use is recorded in an audit trail.
• Erased when you disconnect the account. The account's trading history stays; the password does not.

Send the trading password. An investor password logs in but cannot trade.

The white-label signals portal does not keep that password in the browser or in its own logs. The API still stores an encrypted copy, as this page describes, until the account is disconnected. "Never stored" on a product page means the portal layer, not that no service holds the credential.

What each credential can doCopy Anchor Link

These are different controls. One does not change the others.

API keysCopy Anchor Link

• A key is shown once, when it is created, and we never store the key itself — nobody, including us, can read it back.
• Keys are scoped: give each integration only what it needs, such as trading:reduce for a risk tool that must be able to close but never open.
• Live and test keys are labelled (fx_live_…, fx_test_…), so each configuration is easy to tell apart. Both reach real brokers — test with demo accounts.
• Revoking a key takes effect on its next request.

Keys are server-to-server credentials. Keep them out of browsers, mobile apps and source control. See Authentication.

Signing in to the consoleCopy Anchor Link

• The session cookie is moving to a __Host- cookie, which only fxapis.com itself can set or read, never a subdomain. It is rolling out now; the current cookie name is accepted until the change is complete.
• A session lasts seven days and ends after a day unused.
• Repeated wrong passwords bring a quick human check, then a 15-minute pause for the account, with an email to its owner.
• Making a key that can move money or accounts, widening a key to such a scope or changing limits on a key that already has them, team changes and plan changes ask you to confirm it's you if you have not in the last two hours.
• Every sign-in, failed sign-in, sign-out, password change and two-factor change is in your workspace's audit log. A sign-in from a browser not seen on that network in 30 days is emailed to you.

Your dataCopy Anchor Link

• Every workspace is isolated. Another workspace's account, order or key is simply not found — we do not even confirm that it exists.
• All traffic between you and fxapis is encrypted: the API is only reachable over HTTPS, and credentials stay encrypted when they pass between our own systems.
• Everything that changes an account is audited: connecting, disconnecting, every order, every key issued or revoked.
• Your trading history is kept for the life of the account, because it is what a dispute or an audit is settled with.

Your partCopy Anchor Link

• Issue narrow keys and rotate them. A key with accounts:write can disconnect accounts; a key with trading:execute can open positions.
• Use a dedicated MT5 account for automated trading where you can, and consider turning on your broker's own protections.
• Protect your console sign-in. Members of your workspace can manage its keys according to their role. Turn on two-factor sign-in (an authenticator app, with backup codes) under Security in the console, and check the list of browsers you are signed in on there from time to time.

Reporting a vulnerabilityCopy Anchor Link

Email [email protected]. We acknowledge within one business day. Please do not disclose publicly until we have had a chance to fix it.