# cTrader API: Open API, FIX, cBots and TradingView routes

URL: https://fincodelabs.com/en/blog/ctrader-api · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Stocks, forex and broker APIs · Published: 2026-11-06 · Updated: 2026-11-06

cTrader API routes from official pages: Open API app review, tokens and limits, FIX gaps, cBots, TradingView, plus what testing the Python SDK on a mock showed.

**Short answer:** The **cTrader API** is three routes: Open API for external apps, which needs a cTrader ID and an application that Spotware reviews; FIX 4.4 for market data and orders, with no account data or history; and cTrader Algo, where cBots run inside the platform in C# or Python. cTrader's FAQ, read on 5 November 2026, says TradingView cannot call Open API directly, so automation means a webhook bridge you build, while trading from the chart depends on whether your broker has deployed Spotware's TradingView adapter.

Official pages were read on 5 November 2026. No cTrader ID, application or broker account was used, so live calls were not run; the code below ran against a local mock. Leveraged forex and CFDs can lose money quickly. Access comes through cTrader-affiliated brokers. Rules depend on your country, account types and API access vary, and no broker is recommended, ranked or linked with a referral.

Section 3 of TradingView's [Terms of Use](https://www.tradingview.com/policies/), read on 5 November 2026, licenses charts, alerts and webhooks for display-only use, lists automated trading and automated order generation among prohibited uses, and bars third-party products built for that purpose. That applies to the TradingView bridge below; it is a contract question between you and TradingView, so read the terms and take legal advice.

## cTrader API routes compared

Use Open API for software outside cTrader, FIX when a session-based order link is the requirement, and cBots when the logic can live in the platform.

**cTrader's programming routes, official pages read 5 November 2026**

| Item | Open API | FIX API | cTrader Algo (cBots) |
| --- | --- | --- | --- |
| Runs | Your server or app | Your FIX engine | Windows or Mac app, or cTrader's cloud |
| Language | Any; official SDKs for C# and Python | Any with FIX 4.4 | C# or Python |
| Access | cTrader ID, reviewed application, account token | Credentials in cTrader's settings; no minimum volume or deposit | cTrader ID |
| Account data and history | Yes | No balance, leverage, margin or historical data | Yes |
| Limits | Per connection: 50 requests a second, 5 for historical data | None stated on the pages read | Per connection on demo: 500 new orders a minute, for example |

cTrader's [FAQ](https://ctrader.com/faq/open-api) also describes MCP servers for AI agents, not covered here; it advises supervision and confirmations.

## cTrader API application: who approves it and when

Spotware reviews each application and the docs give no timeframe, so plan the review before the code.

1. Log in to the Open API portal with a cTrader ID and add a new app.
2. The app appears with the status submitted.
3. Spotware contacts you by email to confirm approval or ask for more detail.
4. Add a redirect URI. The default one works only in the playground.

The [create your application](https://help.ctrader.com/open-api/creating-new-app/) page puts coding after approval and says a specific description of why the app is needed improves its chances. [A forum user](https://community.ctrader.com/forum/connect-api-support/40975/) wrote on 3 June 2023 of one week with no answer. The [terms of use](https://help.ctrader.com/open-api/terms-of-use/) call the API free but let Spotware change pricing without notice, restrict access for misuse, and require a trader's explicit prior approval before you trade for them. Demo is the recommended start, though the overview sets no hard restriction.

## cTrader Open API reference facts, with the conflicts

The numbers are clear, but two pages disagree on the host and the SDK disagrees with the heartbeat advice.

**Open API facts, read 5 November 2026**

| Item | Documented value |
| --- | --- |
| OAuth URLs | `id.ctrader.com/my/settings/openapi/grantingaccess/`, then `openapi.ctrader.com/apps/token` |
| Authorization code | Expires in one minute |
| Access token | 2,628,000 seconds, about 30 days |
| Refresh token | No timed expiry; each refresh returns new tokens and invalidates the old ones |
| Scopes | `accounts` (view only), `trading` (full) |
| Ports | 5035 Protobuf, 5036 JSON, on TCP with SSL or WebSocket |
| Connections | At most two: one demo, one live, each carrying any number of accounts |
| Heartbeat | `ProtoHeartbeatEvent` every 10 seconds |
| Rate limits | 50 and 5 requests a second per connection; a rate limit error can carry `retryAfter` in seconds |
| Common errors | `CH_CLIENT_AUTH_FAILURE` (client not activated or wrong credentials), `ACCOUNT_NOT_AUTHORIZED`, `CONNECTIONS_LIMIT_EXCEEDED`, `REQUEST_FREQUENCY_EXCEEDED` |

- **Host conflict.** The [connection page](https://help.ctrader.com/open-api/connection/) examples use `live1.p.ctrader.com`, while the [endpoints page](https://help.ctrader.com/open-api/proxies-endpoints/) and the SDK list `live.ctraderapi.com` and `demo.ctraderapi.com`. Follow the endpoints page unless support says otherwise.
- **Heartbeat conflict.** The docs say every 10 seconds; the SDK source sends one after 20 idle seconds and echoes the server's. Reconnect handling is in [WebSocket heartbeat and reconnect](https://fincodelabs.com/en/blog/websocket-heartbeat-reconnect).
- **Stops on market orders.** The [message reference](https://help.ctrader.com/open-api/messages/) says absolute `stopLoss` and `takeProfit` are not supported on market orders, so an alert carrying a stop price needs `relativeStopLoss` instead.
- **Volume.** It is in 0.01 of a unit: 1000 means 10.00 units, and `lotSize` is in the same cents.

## cTrader API Python: what testing the SDK showed

The official package installs and works against a mock, but its send queue and TLS setup need attention before you put real credentials through it.

Tested on 5 November 2026 with Python 3.11.3 against local TLS mocks, never Spotware's servers. `pip install ctrader-open-api` gave 0.9.2, released 26 June 2024; 0.9.3 is yanked on PyPI and the repository's last commit is dated 7 August 2024. The connection page says the SDK has no WebSocket support, and it uses Twisted.

**Findings in ctrader-open-api 0.9.2 (source read and run)**

| Finding | Evidence | What to do |
| --- | --- | --- |
| Send queue is shared | `TcpProtocol._send_queue` is a class attribute. With a demo and a live client in one process, an order queued on the demo client reached the live mock in 5 to 9 of 20 runs across three tests, depending on timing | Run one process per environment, or subclass with `self._send_queue = deque()` in `__init__`; that went to the right mock in 10 of 10 runs |
| Orders wait in a queue | A 1-second loop flushes up to `numberOfMessagesToSendPerSecond` (default 5); measured waits ran to about 1 second, once 1.7 seconds on a busy machine | Know this before you measure latency; the default also caps sends at 5 a second, well under the documented 50 |
| Server certificate not checked | `Client` connected to a mock with a self-signed certificate, with no trust settings, with or without service-identity; Python's default `ssl` context refused the same mock | A risk for tokens in transit: use your own client with a default `ssl` context, as below, and raise it with Spotware |
| Exact pins | protobuf 3.20.1, Twisted 24.3.0, pyOpenSSL 24.1.0. Twisted warns that `service_identity` is missing, and installing it afterward pulled cryptography 50.0.2, which broke the import | Install both in one command: pip resolved service-identity 24.2.0 with cryptography 42.0.8, which imported cleanly; use a dedicated virtual environment |

Because demo and live are separated, a misrouted message should fail rather than reach the wrong account, but that could not be run here. Store tokens as described in [API key security](https://fincodelabs.com/en/blog/api-key-security-trading-bots).

## Tested cTrader Open API messages without the Twisted client

You can use the SDK's generated message classes with your own framing: a 4-byte big-endian length, then a serialized `ProtoMessage` holding the payload type and payload. The [framing page](https://help.ctrader.com/open-api/protocol-buffers-json/) words this as reversing the length bytes on a little-endian system; the SDK's Twisted receiver uses big-endian.

```python
import asyncio, ssl, struct
from decimal import Decimal
from ctrader_open_api.messages.OpenApiCommonMessages_pb2 import ProtoMessage
from ctrader_open_api.messages.OpenApiMessages_pb2 import (
    ProtoOAApplicationAuthReq, ProtoOAAccountAuthReq, ProtoOANewOrderReq)
from ctrader_open_api.messages.OpenApiModelMessages_pb2 import MARKET, BUY

def frame(msg, msg_id):
    wrapper = ProtoMessage(payloadType=msg.payloadType, clientMsgId=msg_id,
                           payload=msg.SerializeToString())
    data = wrapper.SerializeToString()
    return struct.pack(">I", len(data)) + data       # 4-byte big-endian length

async def read_frame(reader):
    size = struct.unpack(">I", await reader.readexactly(4))[0]
    return ProtoMessage.FromString(await reader.readexactly(size))

def volume(lots, lot_size_cents):
    return int(Decimal(str(lots)) * lot_size_cents)  # never int(lots * lot_size)

def market_order(account, symbol, lots, lot_size_cents, alert_id):
    return ProtoOANewOrderReq(
        ctidTraderAccountId=account, symbolId=symbol, orderType=MARKET, tradeSide=BUY,
        volume=volume(lots, lot_size_cents), clientOrderId=alert_id,
        relativeStopLoss=500)                        # 0.00500 in price; hypothetical

async def run(host, port, tls, client_id, secret, token, account, order):
    reader, writer = await asyncio.open_connection(host, port, ssl=tls)
    steps = [ProtoOAApplicationAuthReq(clientId=client_id, clientSecret=secret),
             ProtoOAAccountAuthReq(ctidTraderAccountId=account, accessToken=token), order]
    replies = []
    for n, msg in enumerate(steps):
        writer.write(frame(msg, f"m{n}"))
        await writer.drain()
        replies.append((await read_frame(reader)).payloadType)
    writer.close()
    return replies
```

In production pass `demo.ctraderapi.com`, 5035 and `ssl.create_default_context()`. This sample has no heartbeat or read loop, and `clientOrderId` (up to 50 characters) should carry your alert ID, with a duplicate check as in [client order ID](https://fincodelabs.com/en/blog/client-order-id). Output against the mock, annotated by hand, where the payload types come from the SDK's messages and the symbol's hypothetical minimum and step are 100,000:

```
volume(1.13, 10_000_000): 11300000 | int(1.13 * 10_000_000): 11299999
0.10 lot:   [2101, 2103, 2126]   app auth, account auth, execution event
volume 10:  [2101, 2103, 2132]   the mock's order error, TRADING_BAD_VOLUME
bad client: [2142, 2142, 2142]   error response on every step
```

> **Hypothetical example.** With `lotSize` 10,000,000 (100,000 units in cents), 1.13 lots should be 11,300,000. `int(1.13 * 10_000_000)` gives 11,299,999, which fails a step check, so convert through `Decimal`. In a sweep of 0.01 to 9.99 lots, 60 values came out wrong this way.

For early development, the FAQ suggests JSON, on port 5036 per the endpoints page, and the overview says JSON needs no SDK. **Not run:** OAuth, account listing, spot events, JSON mode and any call to Spotware's servers.

## cTrader FIX API: what it leaves out

FIX gives market data and orders on version 4.4 with no minimum volume or deposit, per the [FIX overview](https://help.ctrader.com/fix/), but it is narrow.

- **Fixed scope.** The [limitations page](https://help.ctrader.com/fix/limitations/) says its operations cannot be extended, and it offers no balance, leverage, margin or historical data; Spotware points to its other API for those.
- **Two connections.** The [credentials page](https://help.ctrader.com/fix/getting-credentials/) gives separate price and trade credentials in cTrader's settings and warns that FIX symbol IDs can differ across brokers, so a hard-coded ID can hit the wrong symbol.
- **Silence on errors.** The [FAQ](https://help.ctrader.com/fix/faqs/) says an invalid message gets no reply, so check host, port, account number, password and comp IDs first.
- **Duplicate reports.** Reports are copied to every open connection, so a second session doubles what your reconciliation sees.

Session design is covered in [broker API integration](https://fincodelabs.com/en/blog/broker-api-integration-fix-rest).

## cTrader bot options: cBots in C# or Python

A cBot runs inside cTrader with the same trading API in either language, so it needs no application review, but limits and hosting rules apply.

**cBot limits, cTrader Algo pages read 5 November 2026**

| Rule | Value |
| --- | --- |
| New orders on demo | 500 a minute, then no trading for one minute |
| Cancels or amends on demo | 100 a minute each, same penalty |
| Position closes on demo | 2,000 a minute, same penalty |
| Cloud instances | Live up to 10; demo 1, stopping after 7 days; can vary by broker |

The [rate limits page](https://help.ctrader.com/ctrader-algo/documentation/rate-limits/) says a breach also blocks manual trading for the penalty period. Only cBots can run in the [cloud](https://help.ctrader.com/ctrader-algo/documentation/cloud-features/).

## Can you connect cTrader to TradingView?

Yes for trading from the chart, if your broker deployed the integration; for automation only through a bridge you build.

**TradingView to cTrader, official pages read 5 November 2026**

| Item | Broker adapter | Webhook bridge |
| --- | --- | --- |
| What it is | Spotware's adapter linking TradingView to the broker's cTrader backend | TradingView alert, your HTTPS receiver, then Open API or FIX |
| Who sets it up | The broker signs with TradingView and Spotware deploys in 1 to 5 working days | You |
| Automation | None described | Your code, on your alert |

The [FAQ](https://ctrader.com/faq/open-api) explains why a bridge is needed: Open API speaks TCP or WebSocket messages rather than HTTP webhooks, and it advises building on demo first. Receiver design is in [TradingView webhook bot](https://fincodelabs.com/en/blog/tradingview-webhook-bot). Use alerts from rules you wrote, on your own account, with no copy trading across other people's accounts.

For readers in Turkey: the Capital Markets Board (SPK) [said on 23 February 2023](https://spk.gov.tr/duyurular/basin-duyurulari/2023/izinsiz-kaldiracli-islemlere-iliskin-basin-duyurusu) that residents may carry out leveraged FX trades only through firms it has authorized, and offering them without authorization is a crime under Article 109(2) of [Law No. 6362](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf). Article 99(4) lets SPK block such sites, and [Communiqué III-37.1](https://mevzuat.spk.gov.tr/api/Mevzuat/File/130) Articles 9 and 27 define activity aimed at residents and cap leverage at authorized firms.

Fincode quotes custom trading software through its [algorithmic trading](https://fincodelabs.com/en/services/algorithmic-trading) page, from rules you wrote, so it has an interest here; this guide does not say it integrates cTrader, and no prior cTrader project is claimed.

## Frequently asked questions

### Is the cTrader Open API free?

The terms of use read on 5 November 2026 describe it as offered for free, while letting Spotware change pricing without notice. Your broker's charges are separate.

### How long does cTrader API application approval take?

The pages read give no timeframe. Spotware reviews the application and replies by email, approving it or asking for more detail.

### Can I use Python with the cTrader API?

Yes. There is an official Python SDK for Open API, cBots can be written in Python, and any language with TLS and JSON or Protobuf can use Open API directly.

### Does the Python SDK support WebSocket?

No, per the connection page read on 5 November 2026. Use TCP with SSL on port 5035, or your own WebSocket client with JSON on port 5036.

### Which brokers support the cTrader API?

The overview says Open API is available to anyone registered with a cTrader-affiliated broker, and that accounts with such brokers support it by default. No broker is recommended here; check your country's rules.

## Sources

- [cTrader Help Centre: Open API overview (limits, demo and live, SDKs)](https://help.ctrader.com/open-api/)
- [cTrader Help Centre: Register a new application](https://help.ctrader.com/open-api/api-application/)
- [cTrader Help Centre: Account authentication (code, token and refresh lifetimes, scopes)](https://help.ctrader.com/open-api/account-authentication/)
- [cTrader Help Centre: Protobuf and JSON (framing)](https://help.ctrader.com/open-api/protocol-buffers-json/)
- [cTrader Help Centre: Establish a connection](https://help.ctrader.com/open-api/connection/)
- [cTrader Help Centre: Model messages (error codes, lot size)](https://help.ctrader.com/open-api/model-messages/)
- [SPK (Capital Markets Board): Press notice on unauthorized leveraged transactions, 23 February 2023 (Turkish)](https://spk.gov.tr/duyurular/basin-duyurulari/2023/izinsiz-kaldiracli-islemlere-iliskin-basin-duyurusu)
- [Spotware: OpenApiPy repository (client.py, tcpProtocol.py)](https://github.com/spotware/OpenApiPy)
- [PyPI: ctrader-open-api release history (0.9.2, 0.9.3 yanked)](https://pypi.org/project/ctrader-open-api/)
- [cTrader Algo: cBots introduction](https://help.ctrader.com/ctrader-algo/documentation/cbots/)
- [cTrader Algo: Python basics](https://help.ctrader.com/ctrader-algo/documentation/python-basics/)
- [Spotware: TradingView integration](https://www.spotware.com/integrations/tradingview/)
- [Spotware Documentation Centre: How TradingView integration works](https://docs.spotware.com/tradingview-integration/how-it-works/)
- [Spotware Documentation Centre: Requirements for TradingView integration](https://docs.spotware.com/tradingview-integration/requirements-for-integration/)
- [TradingView: Terms of Use, section 3 (read 5 November 2026)](https://www.tradingview.com/policies/)

> This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy).

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/ctrader-api

Cite as: Fincode, "cTrader API: Open API, FIX, cBots and TradingView routes", updated November 6, 2026, https://fincodelabs.com/en/blog/ctrader-api