Skip to main content
POST
Register OAuth application

Authorizations

Authorization
string
header
required

eToro OAuth2. Each operation lists the scopes that grant access as separate security requirements (OpenAPI OR semantics): the caller's token only needs ONE of them — you do NOT need all of them. The same scopes back the x-api-key/x-user-key credential pair.

Headers

x-request-id
string<uuid>
required

A unique request identifier.

Example:

"ae0da95b-9c26-467f-ac70-7678ae407172"

x-api-key
string<password>
required

API key for authentication.

Example:

"lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663"

x-user-key
string<password>
required

User-specific authentication key.

Example:

"eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_"

Body

application/json
applicationName
string
required

Display name shown to end users in the OAuth consent screen.

Maximum string length: 100
Example:

"My Trading App"

applicationIconUrl
string<uri>
required

Publicly reachable URL of the application icon. Format-validated only - the URL is not fetched by the service.

Maximum string length: 500
Example:

"https://cdn.etoro.com/icons/my-app.png"

scopes
object[]
required

Scopes that the application will request from end users. Each scopeId must be positive and present in the cached scope catalog. Duplicates are rejected.

Minimum array length: 1
redirectUris
string<uri>[]
required

OAuth redirect URIs registered for the application. Must be unique. Each URI is capped at 500 characters.

Minimum array length: 1
Maximum string length: 500
Example:

Response

Application created successfully. The clientSecret is included once and only once.

application
object

Full application record. The clientSecret is intentionally excluded.

clientSecret
string<uuid>

OAuth client secret. Returned exactly once at creation time and never again - store it securely.