1. Request an access token (Basic Authentication)

To obtain an access token, send a POST request to:

POST https://www.trade-copier.com/webservice/v4/access/getToken.php
Authorization: Basic <base64(username:password)>

How Basic Authentication works

Basic Authentication sends your cockpit username and password in a single header. The format is:

username:password

This string is then encoded using Base64 and placed in the Authorization header:

Authorization: Basic <base64-encoded-credentials>

For example, if your username is john and your password is MyPass123, the raw string is:

john:MyPass123

After Base64 encoding, it becomes something like:

am9objpNeVBhc3MxMjM=

Most HTTP clients (PHP, Postman, etc.) will generate this header automatically when you provide a username and password.

Example (PHP)

<?php

$username = "your_username";
$password = "your_password";

// Build the raw "username:password" string
$credentials = $username . ":" . $password;

// Encode it in Base64 (this is what Basic Auth requires)
$base64Credentials = base64_encode($credentials);

$ch = curl_init("https://www.trade-copier.com/webservice/v4/access/getToken.php");

curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Add the Authorization header manually
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Basic $base64Credentials"
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Example response

The endpoint returns a JSON object containing your access token and its expiration timestamp:

{
    "token": "eyFakeTokenHeader.eyFakeTokenPayload.abc123FakeSignature",
    "exp": 1771431712
}

The token field contains your JWT access token. The exp field is the expiration time expressed as a Unix timestamp.

2. Use the token for all API requests (Bearer Authentication)

Once you have your token, include it in the Authorization header for every API call:

Authorization: Bearer <your_token_here>

Example (PHP)

<?php
$token = "your_token_here";

$ch = curl_init("https://www.trade-copier.com/webservice/v4/your/endpoint");

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer $token"
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

3. Token expiration (48 hours)

Access tokens are valid for 48 hours. After this period, the token expires and the API will reject requests with an authentication error.

You may request a new token at any time — you do not need to wait for the previous one to expire. We recommend refreshing your token before the 48‑hour limit to avoid interruptions.

4. Summary

• Step 1: Request a token from /webservice/v4/access/getToken.php
  
  using Basic Auth: Authorization: Basic <base64(username:password)>
• Step 2: Use Authorization: Bearer <token> for all API calls.
• Token validity: Tokens expire after 48 hours. Request a new one before expiration.
• Security: All requests must use HTTPS (SSL).