Automated tradingUpdated 3 min readBy the FXNOD team
Deriv API token: what it is, scopes and safety
A Deriv API token is a code you create in your Deriv account that lets software act on that account without your password. Each token has scopes that limit what it can do. Give a trading tool only the scopes it needs, never one that covers payments, and delete any token you no longer use. Treat it like a key.
The scopes
| Scope | What Deriv's guidance says it allows | For a trading bot |
|---|---|---|
| Read | Viewing account activity: settings, limits, balances and purchase history | Usually needed |
| Trade | Buying and selling contracts, and topping up demo accounts | Needed |
| Trading information | Viewing trading history | Sometimes needed |
| Payments | Withdrawals to payment agents and transfers between accounts | Do not grant |
| Admin | Opening accounts, managing settings and managing tokens | Do not grant |
These are the scopes of Deriv's API token page as its community guidance describes them. Deriv also has a newer developer system with different scope names. Read what the screen in front of you says before ticking anything.
Creating one
Sign in on Deriv's own site
Open the API token section of your account settings.
Tick only the scopes you need
Deriv's own guidance is to enable only the access you are comfortable sharing.
Name it after the tool
So you know later what each token is for.
Create and copy it
Store it somewhere private. Do not post it in a chat.
Why Payments and Admin are dangerous
A token with the Payments scope can move money out of the account. A token with Admin can change settings and create more tokens. A stranger's bot that needs either is not a trading bot. Scams that ask for an API token are asking for exactly these.
Token or OAuth?
| API token | OAuth approval | |
|---|---|---|
| You do | Create a token and paste it into the tool | Sign in on Deriv's page and approve the app |
| Scopes chosen by | You | The app asks; Deriv shows you |
| Risk of copying it to the wrong place | Yes | No token to copy |
| Revoke | Delete the token | Remove the app in Deriv's settings |
Keeping tokens safe
- One token per tool, so you can remove one without breaking the others.
- Delete tokens you no longer use. Deriv's token manager shows when each was last used.
- Never send a token to someone setting a bot up for you.
- If a token may have leaked, delete it immediately and check your statement.
FXNOD does not ask for a token
FXNOD connects with OAuth: you sign in on Deriv's own page and approve access there. You never create or paste an API token, and FXNOD never receives your Deriv password. To end the access, disconnect in Connected Accounts or remove FXNOD from the connected apps in your Deriv settings.
Questions people ask
- Is it safe to give a bot my Deriv API token?
- Only a token limited to the scopes the bot needs, to a tool you trust. Never a token with Payments or Admin.
- How do I delete a Deriv API token?
- In the API token section of your Deriv account settings, where your tokens are listed.
- Does FXNOD need my API token?
- No. FXNOD uses Deriv's own login and approval page. There is no token to create or share.
- Can someone withdraw my money with an API token?
- A token with the Payments scope allows transfers and withdrawals to payment agents. A trading tool does not need that scope.
Run a bot that keeps its limits
FXNOD's bots run on its servers and will not start without a stop loss, so your limits hold when your device is off. Build one in Bot Forge or start a ready-made one in Auto Hub, on your Deriv demo account first.
Get started