跳到主要内容

Shared Open API application & rate limits

By default every user registers their own cTrader Open API application under Settings → Open API. A white-label operator (typically a cTrader broker or reseller) can instead ship one shared Open API application for all users — nobody registers their own; everyone authorizes their accounts through the operator's single app.

Two ways to provide the shared application​

The shared application is provisioned either from deployment config or from the owner settings UI (the owner-set value wins). Provide it once and shared-mode turns on for everyone.

1. Deployment config (seeded on startup)​

"App": {
  "OpenApi": {
    "PublicBaseUrl": "https://cmind.yourbroker.com",   // canonical public URL of THIS deployment
    "SharedApp": {
      "Enabled": true,
      "Name": "YourBroker Open API",
      "ClientId": "1234_abcd...",
      "ClientSecret": "…"                                // encrypted at rest; never logged
    }
  }
}

On startup the app seeds one shared application owned by the owner account (idempotent — it never overwrites an owner-edited runtime value, and re-seeding is a no-op).

2. Owner settings (runtime, no redeploy)​

设置 → Open API（仅限所有者）显示两个部分：您的 Open API 应用程序部分 — 所有者注册、编辑和授权自己的每用户应用程序，就像任何用户一样（在未配置共享应用程序时可用）— 以及一个部署共享应用程序卡片来添加/编辑/删除共享应用程序，并显示重定向 URL 供复制粘贴。更改将立即对新授权生效。配置共享应用程序后，它将取代所有者自己的应用程序，您的 Open API 应用程序部分将切换为通知，说明账户现在通过共享应用程序进行授权。

The redirect URL (register this in cTrader)​

Every cTrader Open API application registers one redirect URL — the same single value for the shared app and for any per-user app:

{your deployment URL}/openapi/callback

for example https://cmind.yourbroker.com/openapi/callback.

  • The app displays the exact value on the Open API settings page (with a copy button) — paste it into the cTrader partner portal when you create the Open API application.
  • It is composed from App:OpenApi:PublicBaseUrl so it stays stable behind a reverse proxy / CDN; when that is unset it falls back to the inbound request host.
  • The invite vs normal-user experience differs only in where the user lands after the callback (their accounts list vs an "accounts added" confirmation) — the registered redirect URL is unchanged.

What users see under shared mode​

When a shared application exists:

  • Users get no option to register their own Open API application — the settings page shows "Open API is managed by your provider" and an Authorize accounts button that uses the shared app.
  • Any pre-existing personal applications are removed; their authorized accounts are re-pointed to the shared app and must be re-authorized (their old tokens were issued under a different client id). Attempting to create a personal app returns a "managed by your provider" error.

Client rate limits (per message type)​

The client paces outbound cTrader Open API messages so a burst never trips a server-side rate-limit block. Limits are per message type, matching the cTrader Open API docs:

CategoryWhat it coversDefault
Generaltrading + read messages (orders, symbols, account queries)45 msg/s
HistoricalDatatrendbar / tick-data requests (throttled harder by cTrader)5 msg/s

A historical-data request counts against both its own bucket and the general bucket. Heartbeat and authentication messages are never paced. Messages queue and drain at the available rate — nothing is dropped and order is preserved.

Tune them if your broker negotiated higher cTrader limits, or set a category to 0 to disable pacing entirely (unlimited):

  • Config: App:OpenApi:RateLimits:General / App:OpenApi:RateLimits:HistoricalData (msgs/sec).
  • Owner settings: the Client rate limits card on Settings → Open API (owner override wins, applies to new connections / on reconnect).