MT5 API Key vs Broker Login: What's the Difference?
MetaTrader 5 has no API key of its own. Here is what an API key, an MT5 login, a trading password and a server name each do, and where you get each one.
In short
- MetaTrader 5 and your broker do not issue API keys. They give you an account login, a password and a server name.
- An API key comes from the API provider. With fxapis, it identifies your application to fxapis and decides what it may do.
- You need both: the key on every request, and the account's login, trading password and server once, to connect each account.
- Keep them apart. The key lives on your server; the MT5 password is sent once and never stored by you.
On this page
If you searched for "MT5 API key" and found nothing in MetaTrader's settings, that is because there is none. MetaTrader 5 and your broker give you a login, a password and a server name. An API key comes from the API you trade through. An integration needs both kinds, for different jobs.
Four credentials, two owners
| Credential | Looks like | Issued by | What it does |
|---|---|---|---|
| API key | fx_live_7f3a9c21_ZmQ4… | The API provider (fxapis) | Proves a request comes from your application, and limits what it may do |
| MT5 login | 81234567 | Your broker | The trading account's number |
| Trading password | chosen at the broker | Your broker | Lets software log in to the account and trade it |
| Server name | VantageMarkets-Live | Your broker | Which of the broker's trade servers the account lives on |
The first one belongs to your application. The other three belong to a trading account — yours, or one of your users'.
How they fit together
Connecting an account uses all four, once. Your server sends the account's details to fxapis, authenticated with your key:
curl -X POST https://api.fxapis.com/v1/accounts \
-H "Authorization: Bearer $FXAPIS_KEY" \
-H "Content-Type: application/json" \
-d '{
"login": "81234567",
"server": "VantageMarkets-Live",
"password": "the-trading-password",
"mode": "warm_on_demand"
}'
The answer is an account id. From then on, every request uses the key and that id — never the password again. fxapis encrypts the password on arrival with a key unique to that account, never returns it, and erases it when you disconnect the account.
Getting each one
The API key. Sign up at fxapis.com/sign-up, open the console and create a key under API keys. It is shown once; fxapis stores only a hash, so a lost key is replaced, not recovered. Give each key only the scopes it needs — for example trading:reduce for a risk tool that may close but never open.
The login and password. From the broker, when the account is opened — usually in the welcome email and the broker's client area. Use the trading (master) password. The investor password logs in but cannot trade; see investor vs trading password.
The server name. Shown in MetaTrader next to the account, and in the broker's email. It must match exactly; see how to find your MT5 server name.
Where each one should live
- The API key stays on your server. It is a server-to-server credential: never in a browser, a mobile app or a repository. The
fx_prefix makes a leaked key easy to find with a search. - The MT5 password passes through once. Your connect form posts to your backend, your backend calls
POST /v1/accountsin the same request, and nothing — database, log, queue — keeps a copy. Store the fxapis accountidinstead.
Common mix-ups
- "My API key does not log in to MetaTrader." It is not meant to. The key talks to fxapis; MetaTrader never sees it.
- "The account connected but cannot trade." Usually the investor password was used instead of the trading password.
- "A test key should not trade real money." fxapis labels keys
liveortestso you can tell configurations apart, but both reach real brokers. Test with broker demo accounts.
Next steps
- Create your account and first key.
- The authentication guide covers scopes, rotation and member sessions.
- Connect MT5 accounts covers the connect screen in detail, including what to tell users when a login fails.