curl --request POST \
  --url https://public-api.etoro.com/api/v1/sso/applications \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --header 'x-request-id: <x-request-id>' \
  --header 'x-user-key: <api-key>' \
  --data '
{
  "applicationName": "My Trading App",
  "applicationIconUrl": "https://cdn.etoro.com/icons/my-app.png",
  "scopes": [
    {
      "scopeId": 224,
      "isMandatory": true
    },
    {
      "scopeId": 226,
      "isMandatory": false
    }
  ],
  "redirectUris": [
    "https://myapp.com/oauth/callback"
  ]
}
'

import requests

url = "https://public-api.etoro.com/api/v1/sso/applications"

payload = {
    "applicationName": "My Trading App",
    "applicationIconUrl": "https://cdn.etoro.com/icons/my-app.png",
    "scopes": [
        {
            "scopeId": 224,
            "isMandatory": True
        },
        {
            "scopeId": 226,
            "isMandatory": False
        }
    ],
    "redirectUris": ["https://myapp.com/oauth/callback"]
}
headers = {
    "x-request-id": "<x-request-id>",
    "x-api-key": "<api-key>",
    "x-user-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-request-id': '<x-request-id>',
    'x-api-key': '<api-key>',
    'x-user-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    applicationName: 'My Trading App',
    applicationIconUrl: 'https://cdn.etoro.com/icons/my-app.png',
    scopes: [{scopeId: 224, isMandatory: true}, {scopeId: 226, isMandatory: false}],
    redirectUris: ['https://myapp.com/oauth/callback']
  })
};

fetch('https://public-api.etoro.com/api/v1/sso/applications', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://public-api.etoro.com/api/v1/sso/applications",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'applicationName' => 'My Trading App',
    'applicationIconUrl' => 'https://cdn.etoro.com/icons/my-app.png',
    'scopes' => [
        [
                'scopeId' => 224,
                'isMandatory' => true
        ],
        [
                'scopeId' => 226,
                'isMandatory' => false
        ]
    ],
    'redirectUris' => [
        'https://myapp.com/oauth/callback'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>",
    "x-request-id: <x-request-id>",
    "x-user-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://public-api.etoro.com/api/v1/sso/applications"

	payload := strings.NewReader("{\n  \"applicationName\": \"My Trading App\",\n  \"applicationIconUrl\": \"https://cdn.etoro.com/icons/my-app.png\",\n  \"scopes\": [\n    {\n      \"scopeId\": 224,\n      \"isMandatory\": true\n    },\n    {\n      \"scopeId\": 226,\n      \"isMandatory\": false\n    }\n  ],\n  \"redirectUris\": [\n    \"https://myapp.com/oauth/callback\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-request-id", "<x-request-id>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("x-user-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://public-api.etoro.com/api/v1/sso/applications")
  .header("x-request-id", "<x-request-id>")
  .header("x-api-key", "<api-key>")
  .header("x-user-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"applicationName\": \"My Trading App\",\n  \"applicationIconUrl\": \"https://cdn.etoro.com/icons/my-app.png\",\n  \"scopes\": [\n    {\n      \"scopeId\": 224,\n      \"isMandatory\": true\n    },\n    {\n      \"scopeId\": 226,\n      \"isMandatory\": false\n    }\n  ],\n  \"redirectUris\": [\n    \"https://myapp.com/oauth/callback\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://public-api.etoro.com/api/v1/sso/applications")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-request-id"] = '<x-request-id>'
request["x-api-key"] = '<api-key>'
request["x-user-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"applicationName\": \"My Trading App\",\n  \"applicationIconUrl\": \"https://cdn.etoro.com/icons/my-app.png\",\n  \"scopes\": [\n    {\n      \"scopeId\": 224,\n      \"isMandatory\": true\n    },\n    {\n      \"scopeId\": 226,\n      \"isMandatory\": false\n    }\n  ],\n  \"redirectUris\": [\n    \"https://myapp.com/oauth/callback\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "application": {
    "applicationId": 123,
    "applicationName": "<string>",
    "applicationIconUrl": "<string>",
    "clientId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "audience": "<string>",
    "applicationType": "<string>",
    "scopes": [
      {
        "scopeId": 123,
        "isMandatory": true
      }
    ],
    "redirectUris": [
      "<string>"
    ],
    "supportedFlows": [
      "<string>"
    ],
    "supportedCodeChallengeMethods": [
      "<string>"
    ],
    "ssoIdTokenExpirationInMinutes": 123,
    "ssoRefreshTokenExpirationInMinutes": 123,
    "ssoAccessTokenExpirationInMinutes": 123,
    "adminGcids": [
      123
    ],
    "applicationState": "<string>",
    "allowedGcids": [
      123
    ]
  },
  "clientSecret": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}

{
  "errorCode": "<string>",
  "errorMessage": "<string>"
}

{
  "errorCode": "<string>",
  "errorMessage": "<string>"
}

{
  "errorCode": "<string>",
  "errorMessage": "<string>"
}

SSO - Applications

Register OAuth application

Rate limit: 60 requests per 60 seconds. This is the default shared quota — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

Creates a new OAuth application. The authenticated user automatically becomes the application admin. Both clientId and clientSecret are auto-generated server-side. The clientSecret is returned only in this response (one-time reveal) - subsequent reads will never expose it again, so callers must store it securely. Auto-populated defaults (audience, applicationType, supported flows, token expirations) come from service configuration. Validation: applicationName max 100 chars, applicationIconUrl max 500 chars, each redirectUri max 500 chars and unique, each scopeId positive and recognized in the scope catalog.

POST

api

sso

applications

curl --request POST \
  --url https://public-api.etoro.com/api/v1/sso/applications \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --header 'x-request-id: <x-request-id>' \
  --header 'x-user-key: <api-key>' \
  --data '
{
  "applicationName": "My Trading App",
  "applicationIconUrl": "https://cdn.etoro.com/icons/my-app.png",
  "scopes": [
    {
      "scopeId": 224,
      "isMandatory": true
    },
    {
      "scopeId": 226,
      "isMandatory": false
    }
  ],
  "redirectUris": [
    "https://myapp.com/oauth/callback"
  ]
}
'

import requests

url = "https://public-api.etoro.com/api/v1/sso/applications"

payload = {
    "applicationName": "My Trading App",
    "applicationIconUrl": "https://cdn.etoro.com/icons/my-app.png",
    "scopes": [
        {
            "scopeId": 224,
            "isMandatory": True
        },
        {
            "scopeId": 226,
            "isMandatory": False
        }
    ],
    "redirectUris": ["https://myapp.com/oauth/callback"]
}
headers = {
    "x-request-id": "<x-request-id>",
    "x-api-key": "<api-key>",
    "x-user-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-request-id': '<x-request-id>',
    'x-api-key': '<api-key>',
    'x-user-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    applicationName: 'My Trading App',
    applicationIconUrl: 'https://cdn.etoro.com/icons/my-app.png',
    scopes: [{scopeId: 224, isMandatory: true}, {scopeId: 226, isMandatory: false}],
    redirectUris: ['https://myapp.com/oauth/callback']
  })
};

fetch('https://public-api.etoro.com/api/v1/sso/applications', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://public-api.etoro.com/api/v1/sso/applications",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'applicationName' => 'My Trading App',
    'applicationIconUrl' => 'https://cdn.etoro.com/icons/my-app.png',
    'scopes' => [
        [
                'scopeId' => 224,
                'isMandatory' => true
        ],
        [
                'scopeId' => 226,
                'isMandatory' => false
        ]
    ],
    'redirectUris' => [
        'https://myapp.com/oauth/callback'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>",
    "x-request-id: <x-request-id>",
    "x-user-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://public-api.etoro.com/api/v1/sso/applications"

	payload := strings.NewReader("{\n  \"applicationName\": \"My Trading App\",\n  \"applicationIconUrl\": \"https://cdn.etoro.com/icons/my-app.png\",\n  \"scopes\": [\n    {\n      \"scopeId\": 224,\n      \"isMandatory\": true\n    },\n    {\n      \"scopeId\": 226,\n      \"isMandatory\": false\n    }\n  ],\n  \"redirectUris\": [\n    \"https://myapp.com/oauth/callback\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-request-id", "<x-request-id>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("x-user-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://public-api.etoro.com/api/v1/sso/applications")
  .header("x-request-id", "<x-request-id>")
  .header("x-api-key", "<api-key>")
  .header("x-user-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"applicationName\": \"My Trading App\",\n  \"applicationIconUrl\": \"https://cdn.etoro.com/icons/my-app.png\",\n  \"scopes\": [\n    {\n      \"scopeId\": 224,\n      \"isMandatory\": true\n    },\n    {\n      \"scopeId\": 226,\n      \"isMandatory\": false\n    }\n  ],\n  \"redirectUris\": [\n    \"https://myapp.com/oauth/callback\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://public-api.etoro.com/api/v1/sso/applications")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-request-id"] = '<x-request-id>'
request["x-api-key"] = '<api-key>'
request["x-user-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"applicationName\": \"My Trading App\",\n  \"applicationIconUrl\": \"https://cdn.etoro.com/icons/my-app.png\",\n  \"scopes\": [\n    {\n      \"scopeId\": 224,\n      \"isMandatory\": true\n    },\n    {\n      \"scopeId\": 226,\n      \"isMandatory\": false\n    }\n  ],\n  \"redirectUris\": [\n    \"https://myapp.com/oauth/callback\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "application": {
    "applicationId": 123,
    "applicationName": "<string>",
    "applicationIconUrl": "<string>",
    "clientId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "audience": "<string>",
    "applicationType": "<string>",
    "scopes": [
      {
        "scopeId": 123,
        "isMandatory": true
      }
    ],
    "redirectUris": [
      "<string>"
    ],
    "supportedFlows": [
      "<string>"
    ],
    "supportedCodeChallengeMethods": [
      "<string>"
    ],
    "ssoIdTokenExpirationInMinutes": 123,
    "ssoRefreshTokenExpirationInMinutes": 123,
    "ssoAccessTokenExpirationInMinutes": 123,
    "adminGcids": [
      123
    ],
    "applicationState": "<string>",
    "allowedGcids": [
      123
    ]
  },
  "clientSecret": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}

{
  "errorCode": "<string>",
  "errorMessage": "<string>"
}

{
  "errorCode": "<string>",
  "errorMessage": "<string>"
}

{
  "errorCode": "<string>",
  "errorMessage": "<string>"
}

Authorizations

x-api-key

string

header

default:lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

required

API key of the application. Only valid together with the x-user-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. The pair is granted the same permissions the operation's OAuth scopes describe.

Demo credential for trying the API from these docs: lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

x-user-key

string

header

default:eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

required

User-specific authentication key. Only valid together with the x-api-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it.

Demo credential for trying the API from these docs: eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

Headers

x-request-id

string<uuid>

required

A unique request identifier.

Example:

"38945b86-ad94-41e5-96d8-54b5e2f98abc"

Body

application/json

applicationName

string

required

Display name shown to end users in the OAuth consent screen.

Maximum string length: 100

Example:

"My Trading App"

applicationIconUrl

string<uri>

required

Publicly reachable URL of the application icon. Format-validated only - the URL is not fetched by the service.

Maximum string length: 500

Example:

"https://cdn.etoro.com/icons/my-app.png"

scopes

object[]

required

Scopes that the application will request from end users. Each scopeId must be positive and present in the cached scope catalog. Duplicates are rejected.

Minimum array length: 1

Show child attributes

redirectUris

string<uri>[]

required

OAuth redirect URIs registered for the application. Must be unique. Each URI is capped at 500 characters.

Minimum array length: 1

Maximum string length: 500

Example:

["https://myapp.com/oauth/callback"]

allowedGcids

integer<int64>[]

GCIDs permitted to use this application. Pass an empty array to clear.

Response

Application created successfully. The clientSecret is included once and only once.

application

object

Full application record. The clientSecret is intentionally excluded.

Show child attributes

clientSecret

string<uuid>

OAuth client secret. Returned exactly once at creation time and never again - store it securely.

⌘I

Getting started

Guides

Core API

Deprecated

WebSocket API

Vibe Code

AI Agents

Changelog

Register OAuth application

Authorizations

Headers

Body

Response