Automated tradingUpdated 3 min readBy the FXNOD team
How do trading bots connect to trading platforms?
A trading bot connects to a trading platform through the platform's API, a channel built for software. You authorise it either by approving the tool on the broker's own login page, known as OAuth, or by creating an API token and pasting it into the tool. Either way the bot receives a limited permission, not your password, and you can withdraw it.
The three parts of a connection
| Part | What it does |
|---|---|
| Market data feed | Sends the bot every new price, so it can check its entry rule |
| Authorisation | Proves to the broker that you allowed this tool to act on your account |
| Order channel | Carries the bot's buy and sell requests to the broker and the results back |
OAuth and API tokens compared
| OAuth approval | API token | |
|---|---|---|
| How you grant it | Sign in on the broker's page and press approve | Create a token in the broker's settings and paste it into the tool |
| Does the tool see your password? | No | No |
| Who chooses the permissions? | The tool asks, the broker shows you, you approve | You tick the scopes when you create the token |
| How you revoke it | Remove the app in the broker's settings, or disconnect in the tool | Delete the token in the broker's settings |
FXNOD connects to Deriv with OAuth. You are sent to Deriv's login page, Deriv shows what is being requested, and you return with the accounts under that login listed. The permission is stored encrypted, and running a bot needs a second approval of its own, separate from the one for manual trading.
What a connected bot can and cannot do
- It can do what the permission covers: read balances and prices, and place and close trades on the accounts you approved.
- It should not be able to withdraw your money to someone else. If you create an API token yourself, do not tick payment or withdrawal scopes for a trading bot.
- It cannot change your broker password or your email.
- It stops being able to do anything the moment you revoke the permission at the broker.
Why the connection sometimes drops
Permissions can expire, brokers limit how many requests a tool may send, and networks fail. A well-built bot reconnects on its own and tells you plainly when it cannot. When that happens, reconnect the account and approve again. Never solve it by handing your password to a tool that says it will be more reliable that way.
Three checks before you connect anything
- The address bar shows the broker's real domain when you type your password.
- The approval page names the tool and what it is asking for.
- You know where in your broker's settings to remove it again.
Questions people ask
- Is it safe to connect a bot to my trading account?
- It is as safe as the permission you grant and the tool you grant it to. A connection through the broker's own login, with trading permissions only, and a tool whose rules you can read, is the normal safe arrangement. The trades themselves still carry full market risk.
- What is an API token?
- A long code your broker generates that lets software act on your account within the permissions you chose. Treat it like a key: anyone holding it can use those permissions.
- Can a bot withdraw my money?
- Only if it was given a permission that covers payments. A trading bot does not need one. Check what you are approving before you approve it.
- How do I disconnect a bot?
- Disconnect in the tool, and for certainty remove the app or delete the token in your broker's account settings. The second step cuts access from the broker's side.
Run a bot that keeps its limits
FXNOD's bots run on its servers and will not start without a stop loss, so your limits hold when your device is off. Build one in Bot Forge or start a ready-made one in Auto Hub, on your Deriv demo account first.
Get started