Short answer: The cTrader API is three routes: Open API for external apps, which needs a cTrader ID and an application that Spotware reviews; FIX 4.4 for market data and orders, with no account data or history; and cTrader Algo, where cBots run inside the platform in C# or Python. cTrader's FAQ, read on 5 November 2026, says TradingView cannot call Open API directly, so automation means a webhook bridge you build, while trading from the chart depends on whether your broker has deployed Spotware's TradingView adapter.
Work out lots, units and pip values with your own figures: Forex position size calculator and Pip calculator.
Official pages were read on 5 November 2026. No cTrader ID, application or broker account was used, so live calls were not run; the code below ran against a local mock. Leveraged forex and CFDs can lose money quickly. Access comes through cTrader-affiliated brokers. Rules depend on your country, account types and API access vary, and no broker is recommended, ranked or linked with a referral.
Section 3 of TradingView's Terms of Use (opens in a new tab), read on 5 November 2026, licenses charts, alerts and webhooks for display-only use, lists automated trading and automated order generation among prohibited uses, and bars third-party products built for that purpose. That applies to the TradingView bridge below; it is a contract question between you and TradingView, so read the terms and take legal advice.
cTrader API routes compared
Use Open API for software outside cTrader, FIX when a session-based order link is the requirement, and cBots when the logic can live in the platform.
| Item | Open API | FIX API | cTrader Algo (cBots) |
|---|---|---|---|
| Runs | Your server or app | Your FIX engine | Windows or Mac app, or cTrader's cloud |
| Language | Any; official SDKs for C# and Python | Any with FIX 4.4 | C# or Python |
| Access | cTrader ID, reviewed application, account token | Credentials in cTrader's settings; no minimum volume or deposit | cTrader ID |
| Account data and history | Yes | No balance, leverage, margin or historical data | Yes |
| Limits | Per connection: 50 requests a second, 5 for historical data | None stated on the pages read | Per connection on demo: 500 new orders a minute, for example |
cTrader's FAQ (opens in a new tab) also describes MCP servers for AI agents, not covered here; it advises supervision and confirmations.
cTrader API application: who approves it and when
Spotware reviews each application and the docs give no timeframe, so plan the review before the code.
- Log in to the Open API portal with a cTrader ID and add a new app.
- The app appears with the status submitted.
- Spotware contacts you by email to confirm approval or ask for more detail.
- Add a redirect URI. The default one works only in the playground.
The create your application (opens in a new tab) page puts coding after approval and says a specific description of why the app is needed improves its chances. A forum user (opens in a new tab) wrote on 3 June 2023 of one week with no answer. The terms of use (opens in a new tab) call the API free but let Spotware change pricing without notice, restrict access for misuse, and require a trader's explicit prior approval before you trade for them. Demo is the recommended start, though the overview sets no hard restriction.
cTrader Open API reference facts, with the conflicts
The numbers are clear, but two pages disagree on the host and the SDK disagrees with the heartbeat advice.
| Item | Documented value |
|---|---|
| OAuth URLs | id.ctrader.com/my/settings/openapi/grantingaccess/, then openapi.ctrader.com/apps/token |
| Authorization code | Expires in one minute |
| Access token | 2,628,000 seconds, about 30 days |
| Refresh token | No timed expiry; each refresh returns new tokens and invalidates the old ones |
| Scopes | accounts (view only), trading (full) |
| Ports | 5035 Protobuf, 5036 JSON, on TCP with SSL or WebSocket |
| Connections | At most two: one demo, one live, each carrying any number of accounts |
| Heartbeat | ProtoHeartbeatEvent every 10 seconds |
| Rate limits | 50 and 5 requests a second per connection; a rate limit error can carry retryAfter in seconds |
| Common errors | CH_CLIENT_AUTH_FAILURE (client not activated or wrong credentials), ACCOUNT_NOT_AUTHORIZED, CONNECTIONS_LIMIT_EXCEEDED, REQUEST_FREQUENCY_EXCEEDED |
- Host conflict. The connection page (opens in a new tab) examples use
live1.p.ctrader.com, while the endpoints page (opens in a new tab) and the SDK listlive.ctraderapi.comanddemo.ctraderapi.com. Follow the endpoints page unless support says otherwise. - Heartbeat conflict. The docs say every 10 seconds; the SDK source sends one after 20 idle seconds and echoes the server's. Reconnect handling is in WebSocket heartbeat and reconnect.
- Stops on market orders. The message reference (opens in a new tab) says absolute
stopLossandtakeProfitare not supported on market orders, so an alert carrying a stop price needsrelativeStopLossinstead. - Volume. It is in 0.01 of a unit: 1000 means 10.00 units, and
lotSizeis in the same cents.
cTrader API Python: what testing the SDK showed
The official package installs and works against a mock, but its send queue and TLS setup need attention before you put real credentials through it.
Tested on 5 November 2026 with Python 3.11.3 against local TLS mocks, never Spotware's servers. pip install ctrader-open-api gave 0.9.2, released 26 June 2024; 0.9.3 is yanked on PyPI and the repository's last commit is dated 7 August 2024. The connection page says the SDK has no WebSocket support, and it uses Twisted.
| Finding | Evidence | What to do |
|---|---|---|
| Send queue is shared | TcpProtocol._send_queue is a class attribute. With a demo and a live client in one process, an order queued on the demo client reached the live mock in 5 to 9 of 20 runs across three tests, depending on timing | Run one process per environment, or subclass with self._send_queue = deque() in __init__; that went to the right mock in 10 of 10 runs |
| Orders wait in a queue | A 1-second loop flushes up to numberOfMessagesToSendPerSecond (default 5); measured waits ran to about 1 second, once 1.7 seconds on a busy machine | Know this before you measure latency; the default also caps sends at 5 a second, well under the documented 50 |
| Server certificate not checked | Client connected to a mock with a self-signed certificate, with no trust settings, with or without service-identity; Python's default ssl context refused the same mock | A risk for tokens in transit: use your own client with a default ssl context, as below, and raise it with Spotware |
| Exact pins | protobuf 3.20.1, Twisted 24.3.0, pyOpenSSL 24.1.0. Twisted warns that service_identity is missing, and installing it afterward pulled cryptography 50.0.2, which broke the import | Install both in one command: pip resolved service-identity 24.2.0 with cryptography 42.0.8, which imported cleanly; use a dedicated virtual environment |
Because demo and live are separated, a misrouted message should fail rather than reach the wrong account, but that could not be run here. Store tokens as described in API key security.
Tested cTrader Open API messages without the Twisted client
You can use the SDK's generated message classes with your own framing: a 4-byte big-endian length, then a serialized ProtoMessage holding the payload type and payload. The framing page (opens in a new tab) words this as reversing the length bytes on a little-endian system; the SDK's Twisted receiver uses big-endian.
import asyncio, ssl, struct
from decimal import Decimal
from ctrader_open_api.messages.OpenApiCommonMessages_pb2 import ProtoMessage
from ctrader_open_api.messages.OpenApiMessages_pb2 import (
ProtoOAApplicationAuthReq, ProtoOAAccountAuthReq, ProtoOANewOrderReq)
from ctrader_open_api.messages.OpenApiModelMessages_pb2 import MARKET, BUY
def frame(msg, msg_id):
wrapper = ProtoMessage(payloadType=msg.payloadType, clientMsgId=msg_id,
payload=msg.SerializeToString())
data = wrapper.SerializeToString()
return struct.pack(">I", len(data)) + data # 4-byte big-endian length
async def read_frame(reader):
size = struct.unpack(">I", await reader.readexactly(4))[0]
return ProtoMessage.FromString(await reader.readexactly(size))
def volume(lots, lot_size_cents):
return int(Decimal(str(lots)) * lot_size_cents) # never int(lots * lot_size)
def market_order(account, symbol, lots, lot_size_cents, alert_id):
return ProtoOANewOrderReq(
ctidTraderAccountId=account, symbolId=symbol, orderType=MARKET, tradeSide=BUY,
volume=volume(lots, lot_size_cents), clientOrderId=alert_id,
relativeStopLoss=500) # 0.00500 in price; hypothetical
async def run(host, port, tls, client_id, secret, token, account, order):
reader, writer = await asyncio.open_connection(host, port, ssl=tls)
steps = [ProtoOAApplicationAuthReq(clientId=client_id, clientSecret=secret),
ProtoOAAccountAuthReq(ctidTraderAccountId=account, accessToken=token), order]
replies = []
for n, msg in enumerate(steps):
writer.write(frame(msg, f"m{n}"))
await writer.drain()
replies.append((await read_frame(reader)).payloadType)
writer.close()
return repliesIn production pass demo.ctraderapi.com, 5035 and ssl.create_default_context(). This sample has no heartbeat or read loop, and clientOrderId (up to 50 characters) should carry your alert ID, with a duplicate check as in client order ID. Output against the mock, annotated by hand, where the payload types come from the SDK's messages and the symbol's hypothetical minimum and step are 100,000:
volume(1.13, 10_000_000): 11300000 | int(1.13 * 10_000_000): 11299999
0.10 lot: [2101, 2103, 2126] app auth, account auth, execution event
volume 10: [2101, 2103, 2132] the mock's order error, TRADING_BAD_VOLUME
bad client: [2142, 2142, 2142] error response on every stepHypothetical example. With lotSize 10,000,000 (100,000 units in cents), 1.13 lots should be 11,300,000. int(1.13 * 10_000_000) gives 11,299,999, which fails a step check, so convert through Decimal. In a sweep of 0.01 to 9.99 lots, 60 values came out wrong this way.
For early development, the FAQ suggests JSON, on port 5036 per the endpoints page, and the overview says JSON needs no SDK. Not run: OAuth, account listing, spot events, JSON mode and any call to Spotware's servers.
cTrader FIX API: what it leaves out
FIX gives market data and orders on version 4.4 with no minimum volume or deposit, per the FIX overview (opens in a new tab), but it is narrow.
- Fixed scope. The limitations page (opens in a new tab) says its operations cannot be extended, and it offers no balance, leverage, margin or historical data; Spotware points to its other API for those.
- Two connections. The credentials page (opens in a new tab) gives separate price and trade credentials in cTrader's settings and warns that FIX symbol IDs can differ across brokers, so a hard-coded ID can hit the wrong symbol.
- Silence on errors. The FAQ (opens in a new tab) says an invalid message gets no reply, so check host, port, account number, password and comp IDs first.
- Duplicate reports. Reports are copied to every open connection, so a second session doubles what your reconciliation sees.
Session design is covered in broker API integration.
cTrader bot options: cBots in C# or Python
A cBot runs inside cTrader with the same trading API in either language, so it needs no application review, but limits and hosting rules apply.
| Rule | Value |
|---|---|
| New orders on demo | 500 a minute, then no trading for one minute |
| Cancels or amends on demo | 100 a minute each, same penalty |
| Position closes on demo | 2,000 a minute, same penalty |
| Cloud instances | Live up to 10; demo 1, stopping after 7 days; can vary by broker |
The rate limits page (opens in a new tab) says a breach also blocks manual trading for the penalty period. Only cBots can run in the cloud (opens in a new tab).
Can you connect cTrader to TradingView?
Yes for trading from the chart, if your broker deployed the integration; for automation only through a bridge you build.
| Item | Broker adapter | Webhook bridge |
|---|---|---|
| What it is | Spotware's adapter linking TradingView to the broker's cTrader backend | TradingView alert, your HTTPS receiver, then Open API or FIX |
| Who sets it up | The broker signs with TradingView and Spotware deploys in 1 to 5 working days | You |
| Automation | None described | Your code, on your alert |
The FAQ (opens in a new tab) explains why a bridge is needed: Open API speaks TCP or WebSocket messages rather than HTTP webhooks, and it advises building on demo first. Receiver design is in TradingView webhook bot. Use alerts from rules you wrote, on your own account, with no copy trading across other people's accounts.
For readers in Turkey: the Capital Markets Board (SPK) said on 23 February 2023 (opens in a new tab) that residents may carry out leveraged FX trades only through firms it has authorized, and offering them without authorization is a crime under Article 109(2) of Law No. 6362 (opens in a new tab). Article 99(4) lets SPK block such sites, and Communiqué III-37.1 (opens in a new tab) Articles 9 and 27 define activity aimed at residents and cap leverage at authorized firms.
Fincode quotes custom trading software through its algorithmic trading page, from rules you wrote, so it has an interest here; this guide does not say it integrates cTrader, and no prior cTrader project is claimed.
Frequently asked questions
Is the cTrader Open API free?
The terms of use read on 5 November 2026 describe it as offered for free, while letting Spotware change pricing without notice. Your broker's charges are separate.
How long does cTrader API application approval take?
The pages read give no timeframe. Spotware reviews the application and replies by email, approving it or asking for more detail.
Can I use Python with the cTrader API?
Yes. There is an official Python SDK for Open API, cBots can be written in Python, and any language with TLS and JSON or Protobuf can use Open API directly.
Does the Python SDK support WebSocket?
No, per the connection page read on 5 November 2026. Use TCP with SSL on port 5035, or your own WebSocket client with JSON on port 5036.
Which brokers support the cTrader API?
The overview says Open API is available to anyone registered with a cTrader-affiliated broker, and that accounts with such brokers support it by default. No broker is recommended here; check your country's rules.
Sources
- cTrader Help Centre: Open API overview (limits, demo and live, SDKs) (opens in a new tab)
- cTrader Help Centre: Register a new application (opens in a new tab)
- cTrader Help Centre: Account authentication (code, token and refresh lifetimes, scopes) (opens in a new tab)
- cTrader Help Centre: Protobuf and JSON (framing) (opens in a new tab)
- cTrader Help Centre: Establish a connection (opens in a new tab)
- cTrader Help Centre: Model messages (error codes, lot size) (opens in a new tab)
- SPK (Capital Markets Board): Press notice on unauthorized leveraged transactions, 23 February 2023 (Turkish) (opens in a new tab)
- Spotware: OpenApiPy repository (client.py, tcpProtocol.py) (opens in a new tab)
- PyPI: ctrader-open-api release history (0.9.2, 0.9.3 yanked) (opens in a new tab)
- cTrader Algo: cBots introduction (opens in a new tab)
- cTrader Algo: Python basics (opens in a new tab)
- Spotware: TradingView integration (opens in a new tab)
- Spotware Documentation Centre: How TradingView integration works (opens in a new tab)
- Spotware Documentation Centre: Requirements for TradingView integration (opens in a new tab)
- TradingView: Terms of Use, section 3 (read 5 November 2026) (opens in a new tab)
This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the editorial policy.