SSO with OAuth 2.0

​

Standards conformance

​

Discovery document

curl -s https://www.etoro.com/.well-known/openid-configuration
curl -s https://www.etoro.com/.well-known/jwks.json

​

Prerequisites

​

Step 1 — Redirect the user to eToro

# code_verifier: 43-128 chars of unreserved characters, cryptographically random
# code_challenge = BASE64URL(SHA256(code_verifier))

https://www.etoro.com/sso
  ?response_type=code
  &client_id=<YOUR_CLIENT_ID>
  &redirect_uri=https%3A%2F%2Fmyapp.com%2Foauth%2Fcallback
  &scope=openid%20etoro-public%3Areal%3Aread
  &state=<OPAQUE_RANDOM>
  &nonce=<OPAQUE_RANDOM>
  &code_challenge=<BASE64URL_SHA256_OF_VERIFIER>
  &code_challenge_method=S256

​

Step 2 — Exchange the code for tokens

curl -X POST "https://www.etoro.com/api/sso/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "<YOUR_CLIENT_ID>:<YOUR_CLIENT_SECRET>" \
  -d "grant_type=authorization_code" \
  -d "code=<AUTHORIZATION_CODE>" \
  -d "redirect_uri=https://myapp.com/oauth/callback" \
  -d "code_verifier=<CODE_VERIFIER>"

const body = new URLSearchParams({
  grant_type: 'authorization_code',
  code,
  redirect_uri: 'https://myapp.com/oauth/callback',
  code_verifier: codeVerifier,
});

const res = await fetch('https://www.etoro.com/api/sso/v1/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
    Authorization:
      'Basic ' + Buffer.from(`${clientId}:${clientSecret}`).toString('base64'),
  },
  body,
});

const tokens = await res.json();

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "<ACCESS_TOKEN>",
  "id_token": "<ID_TOKEN_JWT>",
  "refresh_token": "<REFRESH_TOKEN>",
  "scope": "openid etoro-public:real:read"
}

​

Step 3 — Validate the ID token

• Signature against the JWKS key whose kid matches the token header, with alg RS256.
• iss equals https://www.etoro.com exactly.
• aud contains your clientId.
• exp is in the future and iat is not implausibly old (allow only small clock skew).
• nonce equals the nonce you issued for this authorization attempt.
• sub is present. This is your user key.

import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(
  new URL('https://www.etoro.com/.well-known/jwks.json'),
);

const { payload } = await jwtVerify(idToken, JWKS, {
  issuer: 'https://www.etoro.com',
  audience: clientId,
  algorithms: ['RS256'],
  clockTolerance: 30,
});

if (payload.nonce !== expectedNonce) {
  throw new Error('ID token nonce mismatch');
}

// payload.sub is a pairwise pseudonymous identifier, stable for this client.
const etoroSubject = payload.sub;

# Fetch the keys; match the "kid" against the ID token's JWT header,
# then verify RS256 with your JWT library of choice.
curl -s https://www.etoro.com/.well-known/jwks.json

{
  "keys": [
    {
      "kty": "RSA",
      "alg": "RS256",
      "use": "sig",
      "kid": "00043",
      "n": "<MODULUS>",
      "e": "AQAB"
    }
  ]
}

​

Calling the API with the token

curl -X GET "https://public-api.etoro.com/api/v1/watchlists" \
  -H "x-request-id: <UUID>" \
  -H "Authorization: Bearer <ACCESS_TOKEN>"

​

Identity and personal data

• Identity is the sub claim. Use it as the primary key associating your user record with the eToro user, and resolve it on every subsequent sign-in.
• Authorization is the scope set on the token. Never infer entitlement from anything the user typed into your application.
• No PII joins. Do not build account matching, reconciliation, deduplication, or support lookups on email address, name, or phone number. Beyond being unavailable by default, matching on user-supplied attributes is an account-takeover vector: any party able to register that value in your application would inherit the corresponding eToro account.
• A scope is permission to call, not permission to receive PII. Where an operation would return personal data, a separate data-sharing approval governs what is returned.

​

Token lifecycle

​

Security checklist

• PKCE S256 on every authorization request — no exceptions, including for confidential clients.
• state verified against the browser session on every callback; nonce verified inside every ID token.
• Exact-match redirect URIs, HTTPS, pointing at your backend.
• ID token signature, iss, aud, exp, and nonce all verified, with alg restricted to RS256 and JWKS keys fetched by kid.
• Client secret and refresh tokens held in a secret store — never in source, never in a repository, never in a log line, never in an error payload, never returned to the browser.
• A working revocation path for the refresh token, wired to your own user-offboarding flow.
• x-request-id set to a fresh UUID on every API call, so a failure is traceable end to end across both systems.
• No PII in the account association, the logs, or the analytics.

​

Reference