Create Sub-Account User Token

curl --request POST \
  --url https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --header 'x-request-id: <x-request-id>' \
  --header 'x-sub-account-id: <x-sub-account-id>' \
  --header 'x-user-key: <api-key>' \
  --data '
{
  "userTokenName": "my-trading-bot",
  "scopeNames": [
    "etoro-public:trade.real:read",
    "etoro-public:trade.real:write"
  ],
  "ipsWhitelist": [
    "192.168.1.1"
  ],
  "expiresAt": "2026-12-31T23:59:59Z"
}
'

import requests

url = "https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens"

payload = {
    "userTokenName": "my-trading-bot",
    "scopeNames": ["etoro-public:trade.real:read", "etoro-public:trade.real:write"],
    "ipsWhitelist": ["192.168.1.1"],
    "expiresAt": "2026-12-31T23:59:59Z"
}
headers = {
    "x-request-id": "<x-request-id>",
    "x-sub-account-id": "<x-sub-account-id>",
    "x-api-key": "<api-key>",
    "x-user-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-request-id': '<x-request-id>',
    'x-sub-account-id': '<x-sub-account-id>',
    'x-api-key': '<api-key>',
    'x-user-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    userTokenName: 'my-trading-bot',
    scopeNames: ['etoro-public:trade.real:read', 'etoro-public:trade.real:write'],
    ipsWhitelist: ['192.168.1.1'],
    expiresAt: '2026-12-31T23:59:59Z'
  })
};

fetch('https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'userTokenName' => 'my-trading-bot',
    'scopeNames' => [
        'etoro-public:trade.real:read',
        'etoro-public:trade.real:write'
    ],
    'ipsWhitelist' => [
        '192.168.1.1'
    ],
    'expiresAt' => '2026-12-31T23:59:59Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>",
    "x-request-id: <x-request-id>",
    "x-sub-account-id: <x-sub-account-id>",
    "x-user-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens"

	payload := strings.NewReader("{\n  \"userTokenName\": \"my-trading-bot\",\n  \"scopeNames\": [\n    \"etoro-public:trade.real:read\",\n    \"etoro-public:trade.real:write\"\n  ],\n  \"ipsWhitelist\": [\n    \"192.168.1.1\"\n  ],\n  \"expiresAt\": \"2026-12-31T23:59:59Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-request-id", "<x-request-id>")
	req.Header.Add("x-sub-account-id", "<x-sub-account-id>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("x-user-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens")
  .header("x-request-id", "<x-request-id>")
  .header("x-sub-account-id", "<x-sub-account-id>")
  .header("x-api-key", "<api-key>")
  .header("x-user-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"userTokenName\": \"my-trading-bot\",\n  \"scopeNames\": [\n    \"etoro-public:trade.real:read\",\n    \"etoro-public:trade.real:write\"\n  ],\n  \"ipsWhitelist\": [\n    \"192.168.1.1\"\n  ],\n  \"expiresAt\": \"2026-12-31T23:59:59Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-request-id"] = '<x-request-id>'
request["x-sub-account-id"] = '<x-sub-account-id>'
request["x-api-key"] = '<api-key>'
request["x-user-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"userTokenName\": \"my-trading-bot\",\n  \"scopeNames\": [\n    \"etoro-public:trade.real:read\",\n    \"etoro-public:trade.real:write\"\n  ],\n  \"ipsWhitelist\": [\n    \"192.168.1.1\"\n  ],\n  \"expiresAt\": \"2026-12-31T23:59:59Z\"\n}"

response = http.request(request)
puts response.read_body

{
  "userTokenId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "userToken": "ut_live_9f8c7b6a5d4e3f2a1b0c",
  "userTokenName": "my-trading-bot",
  "clientId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "ipsWhitelist": [
    "192.168.1.1"
  ],
  "scopes": [
    {
      "name": "etoro-public:trade.real:read"
    }
  ],
  "expiresAt": "2026-12-31T23:59:59Z",
  "createdAt": "2026-06-06T10:15:00Z"
}

POST

api

sub-accounts

etoro-trading

user-tokens

Create Sub-Account User Token

curl --request POST \
  --url https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --header 'x-request-id: <x-request-id>' \
  --header 'x-sub-account-id: <x-sub-account-id>' \
  --header 'x-user-key: <api-key>' \
  --data '
{
  "userTokenName": "my-trading-bot",
  "scopeNames": [
    "etoro-public:trade.real:read",
    "etoro-public:trade.real:write"
  ],
  "ipsWhitelist": [
    "192.168.1.1"
  ],
  "expiresAt": "2026-12-31T23:59:59Z"
}
'

import requests

url = "https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens"

payload = {
    "userTokenName": "my-trading-bot",
    "scopeNames": ["etoro-public:trade.real:read", "etoro-public:trade.real:write"],
    "ipsWhitelist": ["192.168.1.1"],
    "expiresAt": "2026-12-31T23:59:59Z"
}
headers = {
    "x-request-id": "<x-request-id>",
    "x-sub-account-id": "<x-sub-account-id>",
    "x-api-key": "<api-key>",
    "x-user-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-request-id': '<x-request-id>',
    'x-sub-account-id': '<x-sub-account-id>',
    'x-api-key': '<api-key>',
    'x-user-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    userTokenName: 'my-trading-bot',
    scopeNames: ['etoro-public:trade.real:read', 'etoro-public:trade.real:write'],
    ipsWhitelist: ['192.168.1.1'],
    expiresAt: '2026-12-31T23:59:59Z'
  })
};

fetch('https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'userTokenName' => 'my-trading-bot',
    'scopeNames' => [
        'etoro-public:trade.real:read',
        'etoro-public:trade.real:write'
    ],
    'ipsWhitelist' => [
        '192.168.1.1'
    ],
    'expiresAt' => '2026-12-31T23:59:59Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>",
    "x-request-id: <x-request-id>",
    "x-sub-account-id: <x-sub-account-id>",
    "x-user-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens"

	payload := strings.NewReader("{\n  \"userTokenName\": \"my-trading-bot\",\n  \"scopeNames\": [\n    \"etoro-public:trade.real:read\",\n    \"etoro-public:trade.real:write\"\n  ],\n  \"ipsWhitelist\": [\n    \"192.168.1.1\"\n  ],\n  \"expiresAt\": \"2026-12-31T23:59:59Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-request-id", "<x-request-id>")
	req.Header.Add("x-sub-account-id", "<x-sub-account-id>")
	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("x-user-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens")
  .header("x-request-id", "<x-request-id>")
  .header("x-sub-account-id", "<x-sub-account-id>")
  .header("x-api-key", "<api-key>")
  .header("x-user-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"userTokenName\": \"my-trading-bot\",\n  \"scopeNames\": [\n    \"etoro-public:trade.real:read\",\n    \"etoro-public:trade.real:write\"\n  ],\n  \"ipsWhitelist\": [\n    \"192.168.1.1\"\n  ],\n  \"expiresAt\": \"2026-12-31T23:59:59Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://public-api.etoro.com/api/v1/sub-accounts/etoro-trading/user-tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-request-id"] = '<x-request-id>'
request["x-sub-account-id"] = '<x-sub-account-id>'
request["x-api-key"] = '<api-key>'
request["x-user-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"userTokenName\": \"my-trading-bot\",\n  \"scopeNames\": [\n    \"etoro-public:trade.real:read\",\n    \"etoro-public:trade.real:write\"\n  ],\n  \"ipsWhitelist\": [\n    \"192.168.1.1\"\n  ],\n  \"expiresAt\": \"2026-12-31T23:59:59Z\"\n}"

response = http.request(request)
puts response.read_body

{
  "userTokenId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "userToken": "ut_live_9f8c7b6a5d4e3f2a1b0c",
  "userTokenName": "my-trading-bot",
  "clientId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "ipsWhitelist": [
    "192.168.1.1"
  ],
  "scopes": [
    {
      "name": "etoro-public:trade.real:read"
    }
  ],
  "expiresAt": "2026-12-31T23:59:59Z",
  "createdAt": "2026-06-06T10:15:00Z"
}

Authorizations

x-api-key

string

header

default:lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

required

API key of the application. Only valid together with the x-user-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. The pair is granted the same permissions the operation's OAuth scopes describe.

Demo credential for trying the API from these docs: lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663

x-user-key

string

header

default:eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

required

User-specific authentication key. Only valid together with the x-api-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it.

Demo credential for trying the API from these docs: eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_

Headers

x-request-id

string<uuid>

required

A unique request identifier.

Example:

"72fb21f5-a7bb-4858-a9e3-a8526b695649"

x-sub-account-id

string

required

The encrypted sub-account identifier. The backend validates that it decrypts to a sub-account owned by the caller's token gcid and generates the token for the sub-account's gcid.

Body

application/json

userTokenName

string

required

A friendly display name for the user token.

Example:

"my-trading-bot"

scopeNames

string[]

required

The scope names to assign. Must be a subset of the scopes returned by GET /api/v1/sub-accounts/etoro-trading/user-tokens/scopes.

Example:

[
  "etoro-public:trade.real:read",
  "etoro-public:trade.real:write"
]

ipsWhitelist

string[]

An optional IPv4 whitelist for the token.

Example:

["192.168.1.1"]

expiresAt

string<date-time>

An optional UTC expiration for the token.

Example:

"2026-12-31T23:59:59Z"

Response

User token created successfully

userTokenId

string<uuid>

The unique identifier of the created user token.

Example:

"3fa85f64-5717-4562-b3fc-2c963f66afa6"

userToken

string

The secret token value. Returned only once, on creation.

Example:

"ut_live_9f8c7b6a5d4e3f2a1b0c"

userTokenName

string

The friendly display name assigned to the token.

Example:

"my-trading-bot"

clientId

string<uuid>

The OAuth client id associated with the token.

Example:

"7c9e6679-7425-40de-944b-e07fc1f90ae7"

ipsWhitelist

string[]

The IPv4 addresses the token is restricted to, if any.

Example:

["192.168.1.1"]

scopes

object[]

The scopes granted to the token.

Show child attributes

expiresAt

string<date-time> | null

The UTC expiration of the token, if one was set.

Example:

"2026-12-31T23:59:59Z"

createdAt

string<date-time>

When this user token was created.

Example:

"2026-06-06T10:15:00Z"

⌘I

Getting started

Guides

Core API

Deprecated

WebSocket API

Vibe Code

AI Agents

Changelog

Create Sub-Account User Token

Authorizations

Headers

Body

Response