Skip to main content
PATCH
/
api
/
v2
/
agent-portfolios
/
{agentPortfolioId}
/
user-tokens
/
{userTokenId}
Update User Token (v2)
curl --request PATCH \
  --url https://public-api.etoro.com/api/v2/agent-portfolios/{agentPortfolioId}/user-tokens/{userTokenId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <x-api-key>' \
  --header 'x-request-id: <x-request-id>' \
  --header 'x-user-key: <x-user-key>' \
  --data '
{
  "scopeNames": [
    "etoro-public:trade.real:read",
    "etoro-public:trade.real:write"
  ],
  "ipsWhitelist": [
    "192.168.1.1"
  ],
  "expiresAt": "2026-12-31T23:59:59Z"
}
'

Authorizations

​
Authorization
string
header
required

eToro OAuth2. Each operation lists the scopes that grant access as separate security requirements (OpenAPI OR semantics): the caller's token only needs ONE of them — you do NOT need all of them. The same scopes back the x-api-key/x-user-key credential pair.

Headers

​
x-request-id
string<uuid>
required

A unique request identifier.

Example:

"905f854a-45ba-4e33-98ee-d219c8cd4c68"

​
x-api-key
string<password>
required

API key for authentication.

Example:

"lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663"

​
x-user-key
string<password>
required

User-specific authentication key.

Example:

"eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_"

Path Parameters

​
agentPortfolioId
string<uuid>
required

The unique identifier of the agent-portfolio.

​
userTokenId
string<uuid>
required

The unique identifier of the user token to update.

Body

application/json
​
scopeNames
string[]

An updated set of permission scope names for the token. Available scopes: etoro-public:trade.real:read, etoro-public:trade.real:write, etoro-public:trade.demo:read, etoro-public:trade.demo:write.

Example:
[
  "etoro-public:trade.real:read",
  "etoro-public:trade.real:write"
]
​
ipsWhitelist
string[]

An updated set of IPv4 addresses allowed to use this token.

Example:
["192.168.1.1"]
​
expiresAt
string<date-time>

An updated expiration date and time (UTC) for the token.

Example:

"2026-12-31T23:59:59Z"

Response

User token updated successfully