Connecting a broker takes five steps, and the same five apply whichever broker you use. The screens differ; the mechanism does not. This guide covers the process, what can go wrong at each stage, and how long to allow.
The five steps
| Step | Where it happens | What you get |
|---|---|---|
| 1. Create an API app | Your broker's developer portal | An API key and secret |
| 2. Whitelist your address | The same API app | Orders from that address are accepted |
| 3. Add credentials | Arthalab, Broker Setup | The connection is configured |
| 4. Complete the broker login | A redirect to your broker | Today's session token |
| 5. Validate | Arthalab, Network tab | Proof the whole path works |
Steps one and two happen once. Step four happens every trading day on the self-serve brokers. Step five happens whenever something changes.
Step 1 — the API app
This is created in your broker's developer or API portal, which is a different place from the trading app you normally use. Some brokers approve new apps instantly; others take a day.
You receive two values: an API key, which identifies the application, and a secret, which proves requests come from it. Both are generated by your broker and revocable by you at any time.
Step 2 — whitelisting
The API app has a field for allowed IP addresses. Orders arriving from anywhere else are refused, regardless of how valid the key is.
Use the public address your platform displays, not the address shown in your router or your machine's network settings — those are private local addresses the broker never sees.
Before you whitelist anything
If you do not have a fixed address yet, sort that out before continuing. Whitelisting a dynamic address works today and fails silently later.
Step 3 — adding credentials
In Broker Setup, select your broker and enter the key and secret. They are encrypted before being stored and are never displayed back, including to admin users.
Some brokers need additional fields. XTS connections, for example, require your broker's own API base URL, which is why XTS is enabled on request rather than self-serve.
Step 4 — the broker login
Most brokers use a redirect-based login: you are sent to the broker, you authenticate there, and you are returned with a session token valid for the day.
This repeats every trading day on the self-serve brokers. It is interactive by design and cannot be automated — anything claiming to automate it needs your broker password stored somewhere.
The exception
XTS differs here: its session is renewed server-side, so there is no daily step for you.
Step 5 — validation
Validation places a small real order and reverses it. It is the only test that exercises the complete path — key, secret, address, session and order routing.
Keep a small balance available for it, and run it when the market is open and liquid rather than in the first minute of the session.
How long to allow
Connecting a broker is not a five-minute job the first time, and planning for that avoids doing it under pressure before the open.
- Day one. Create the API app. Some brokers approve instantly, some take a day.
- Day one. Get your dedicated address and whitelist it.
- Day two. Add credentials, log in, validate. Read any error rather than retrying blindly.
- Day two onwards. Paper trade while the morning routine beds in.
- Week two. Go live at minimum size.
What goes wrong, by step
| Step | Common failure | Fix |
|---|---|---|
| API app | Approval pending | Wait — nothing downstream works until it is active |
| Whitelisting | Private address used instead of public | Use the address your platform shows |
| Whitelisting | Trailing space when pasting | Re-copy and check the field |
| Credentials | Key and secret transposed | Re-enter from the portal |
| Login | Not completed today | Complete it — this is the most common cause of everything |
| Validation | Balance too low | Add funds; the test places a real order |
The fifth row accounts for more failures than the rest combined, and it recurs daily rather than once.
Connecting more than one
You can hold several broker connections and choose which one a strategy deploys to. Each needs its own API app, its own whitelist entry and its own daily login.
Two self-serve brokers means two logins every morning, which is a real cost on a routine that has to be completed before the open. Weigh that against whatever you gain from the second connection.
Before you start
- A dedicated IP address that is genuinely reserved for you
- An active plan
- Access to your broker's developer portal
- A small balance for validation
- A day or two before you intend to trade live
None of this is needed to backtest or paper trade. Connect a broker when you have a strategy that has earned real money, not before.
The short version
- Five steps: API app, whitelist, credentials, login, validate
- Steps one and two happen once; the login happens every trading day
- Use the public address your platform shows, never your router's
- Expect to fail validation once — do not regenerate the key first
- Allow a day or two rather than doing it the morning you want to trade
Frequently asked questions
Allow a day or two. The API app may need approval, whitelisting has to be done, and a first validation failure is close to guaranteed. Doing it the morning you want to trade is how it goes wrong.
The public address your platform displays. The address in your router or machine network settings is a private local address the broker never sees.
If your broker allows it, yes. It lets you revoke one platform's access without disrupting others and makes unexpected activity attributable.
Usually the daily login was not completed, a stray character got into the pasted address, or a whitelist change had not propagated. None of those require regenerating your API key.
On the self-serve brokers, yes — sessions expire daily and the login is interactive by design. XTS is the exception, as its session is renewed server-side.
Yes, and you choose which one a strategy deploys to. Each needs its own API app, whitelist entry and daily login, so two self-serve brokers means two logins every morning.
No. Neither sends an order to a broker, so neither needs a connection, an IP or any capital.
Start with a free 3-day trial
Build a strategy, backtest it and run it on paper — no broker, no IP and no money needed to try it.
