An MT4 and MT5 API for trading apps and client portals
Tickwire runs a real MT4 or MT5 terminal for each of your users' accounts and gives your app REST, WebSocket and signed webhooks. Keys can be read-only and limited to the accounts you choose. A browser gets a token that expires, never your key.
How the pieces fit
Your key stays on your server. The browser only ever holds a short-lived token.
- Your server holds the key. Use a read-only key for a dashboard or a portal. Call REST from your server. Browsers may call the REST API only from Tickwire's own sites.
- Your server mints a token per viewer. It lists the viewer's accounts, can be read-only, and expires after the hours you set.
- The browser opens the WebSocket. It passes the token, gets a full sync, then each change as it happens.
- Webhooks reach your server. Disconnects, failed logins, margin calls and trades arrive signed, so your app can tell the user.
Keys and tokens that only do what they must
Read-only keys for selected accounts
A read-only key reads balances, quotes, positions and history. It can't trade or change settings. You can limit it to the accounts you pick. Key kinds.
Short-lived tokens for browsers
Mint a scoped token from your key with POST /users/current/tokens. Set the accounts,
read-only, a time to live and an optional IP allowlist. A token can never do more than the key it came
from. Revoke it at any time.
Investor-password read-only mode
If your users connect with the investor password, the account is read-only at the broker. The terminal can't trade at all, and health shows the login as read-only. Your users give you access without giving you their account. The journal guide.
Shown once, stored hashed
Every key and token value is shown once, when you create it. We keep only a hash. Creating, rotating or revoking a key never restarts a terminal or drops a broker connection.
# On your server: one short-lived, read-only token for one viewer
curl -s -X POST "https://api.tickwire.io/users/current/tokens" \
-H "auth-token: $TW_KEY" \
-H "Idempotency-Key: portal-u42-2026-11-01T10" \
-H "content-type: application/json" \
-d '{"name": "portal user 42", "accountIds": ["acc_7Qx"],
"readOnly": true, "ttlInHours": 1}'
A REST call with a key in its URL is refused with 401 query_token_not_allowed. Send keys in
headers. See Authentication.
// In the browser: the token from your server, never your key
const ws = new WebSocket(`wss://api.tickwire.io/users/current/accounts/acc_7Qx/ws?auth-token=${token}`);
ws.onopen = () => ws.send(JSON.stringify({
type: "subscribe",
sync: { sessionId, lastSeq }, // null on the first connect
marketData: [{ symbol: "EURUSD" }],
}));
ws.onmessage = (m) => {
const f = JSON.parse(m.data);
lastSeq = f.seq;
if (f.type === "accountInformationUpdated") render(f.accountInformation);
if (f.type === "health") showStatus(f.health.status);
};Live data over WebSocket
- One socket per account. A full sync of account, positions, orders and history, then each change.
- Prices with equity. Quotes and candles for the symbols you pick, with the account's equity and margin.
- Resume after a drop. Send your
sessionIdand lastseqto get the missed frames, or a fresh sync. - Health on the same socket. Show a stale or disconnected account as what it is, not as the last numbers you saw.
Signed webhooks
Register an endpoint with /v1/webhooks and choose its events: health changes, connects and
disconnects, failed logins, margin calls, stop-outs, positions and orders. Each delivery is signed with
HMAC-SHA256 and a timestamp, so you can reject fakes and replays. Failed deliveries are retried, and you can
read the delivery log and resend.
Build on the free sandbox
The sandbox gives you simulated MT4 and MT5 accounts on the real API. No card, no broker login, no wait for a terminal. Sandbox keys can't touch a live account, and every sandbox answer is marked. Up to 5 accounts per sandbox.
Pricing that grows per account
| Plan | Price |
|---|---|
| Starter | $12 an account a month |
| Pro | $649 a month with 60 accounts, then $11 each |
| Premium | $1,099 a month with 110 accounts, then $9 each |
The cheapest plan for your count is applied. Pricing.
Questions
Can I call the Tickwire API straight from a web page?
Not the REST API. Browsers may call it only from Tickwire's own sites, so your key never sits in a page. Call REST from your server. For live data in the browser, your server mints a short-lived scoped token and the page opens the WebSocket with it.
How do I stop one client seeing another client's account?
Give each viewer a token limited to their accounts. A scoped token lists the accounts it can read, can be read-only, and expires after the hours you set. A read-only key can also be limited to selected accounts.
Can my app read an account without being able to trade it?
Yes, in two ways. A read-only key or token can't trade or change settings. And if your user connects with the investor password, the account is read-only at the broker, so the terminal can't trade at all.
What happens when the WebSocket drops?
Keep the sessionId and the last seq you handled. Reconnect and subscribe with both. If we still hold the missed frames we replay them. If not, you get a fresh full sync in the same session.
Can I build and test before I pay?
Yes. The sandbox is free, needs no card and gives you simulated MT4 and MT5 accounts on the real API. Live accounts start with a 7-day free trial.
How does the price grow with my users?
You pay per account. Starter is $12 an account a month. Pro is $649 a month with 60 accounts, then $11 each. Premium is $1,099 with 110, then $9. The cheapest plan for your count is applied.
Does it work on MT4 and MT5?
Yes. Both share the same API. A few MT5-only features, such as market depth and ticks, answer not_supported_on_mt4 on MT4. Account data, positions, history and the stream work on both.
The MT5 API
The MT4 API
How health works
Rate limits
API reference
Prop firm API
Build your app
Free sandbox to build. 7-day free trial on a live account. Then from $12 per account a month. See pricing. Test on a demo account first.