Three mechanisms connect a trading account to software, and they grant very different things. What OAuth actually hands over, why MetaTrader still needs a password, what a webhook URL really is, and how to revoke each one when you change your mind.
A new member links four accounts in eleven minutes. Two of them — a cTrader account and a Tradovate account — never asked for a password. The other two, both MetaTrader, asked for a login, a password and a server name. Same product, same dashboard, two completely different security models, and almost nobody stops to ask why.
The answer to the headline question, before the detail: there are three ways a trading account gets linked to software, and they grant different things. OAuth sends you to the platform's own login page and returns a revocable token; the software never receives your password. Stored credentials mean the software holds a login that can act as you until you change it. An API key or webhook URL is a secret string that grants whatever the issuing platform decided it grants. Which one you get is chosen by the platform, not by the vendor — and the revocation procedure is different for each.
INFO
Quick answer. cTrader and Tradovate link by OAuth: you log in on their site, approve, and we hold a token you can revoke from your platform account without changing any password. MT4 and MT5 have no OAuth, so linking means storing your login, password and server, encrypted at rest; you revoke by changing the password at your broker. TradingView links by webhook URL, which is a secret to be rotated rather than an account login.
If you have ever clicked "continue with Google" on a third-party site, you have used OAuth. The shape is the same for trading platforms.
You click connect. Your browser goes to the platform's own domain — not ours — where you log in with credentials that we never see and cannot see, because they are typed into a page we do not serve. The platform shows you what is being requested and which accounts it covers. You approve. The platform redirects your browser back to us with a short-lived code, which our server exchanges for an access token and a refresh token.
What we then hold is a token. Four properties of a token matter to you:
This is the model we use wherever the platform offers it, which today means cTrader and Tradovate. It is the better model by a wide margin and it is not always available.
One structural detail about cTrader specifically, because it surprises people who go looking for it. A cTrader Open API connection does not open a socket to your broker. It reaches the broker's backend through cTrader's own proxy cloud, on Spotware's endpoints, which is how the API is designed. Your broker therefore never sees a client address — neither yours nor any vendor's — and there is no dedicated-address option to buy on that platform.
MetaTrader 4 and MetaTrader 5 have no OAuth. There is no authorisation server, no consent screen and no token. The only way any software connects to an MT account — every copier, every journal, every analytics site, without exception — is by logging in with the account number, the password and the broker's server name, exactly as your terminal does.
That is the honest description, and it is worth being precise about the consequences rather than reassuring about them.
A stored trading password can place trades. That is the point: a copier that cannot place trades is not a copier. MetaTrader's read-only investor password exists and is genuinely useful for monitoring, but it cannot execute, so it cannot be the credential a copier uses on a Follower account.
Encryption at rest protects a stolen database, not a compromised service. AES-256-GCM means a dump of the storage is useless without the key. It does not mean a credential is beyond use by the system that legitimately holds it. Anyone who tells you otherwise is describing cryptography they have not thought about.
Revocation is yours and it is instant. Change the trading password at your broker and every stored copy of it, ours included, stops working the same second. This is the real control, and it is stronger than any vendor's delete button because it does not depend on the vendor.
The terminal that logs in is not on your desk. For a hosted service to trade a MetaTrader account, a MetaTrader terminal has to be running somewhere, and for us that somewhere is our execution provider's cloud, in whichever region your account is homed. Your broker's session log therefore shows that provider's data centre rather than your home connection. This is how effectively every hosted MetaTrader tool works, and it is worth knowing because it makes a "dedicated IP" offer on a MetaTrader account close to meaningless: the dedicated part is rarely the hop the broker actually sees.
Three practices follow, and they apply to every MT-connected service you use, not only ours:
WARNING
If a service asks for your MetaTrader credentials and also asks for your broker's client-portal login, stop. The portal login is the one that can withdraw funds. No trading tool needs it, and there is no legitimate reason to be asked.
The third mechanism is a secret string, and it appears in two places in a normal setup.
A webhook URL is how TradingView reaches your account. You paste a URL into an alert; when the alert fires, TradingView posts a message to it. The URL contains a secret. Treat it exactly like a password: anyone who has it can send messages to your endpoint. Do not paste it into a screenshot, a public Pine script, a Discord channel or a support ticket, and rotate it if you ever suspect it has leaked.
An exchange API key — key plus secret, and sometimes a permission set you choose at creation. Where these are used, the permissions are the whole story. A key created with trading enabled and withdrawals disabled cannot move money off the exchange no matter what happens to it, and that distinction is available to you at creation time on every serious venue.
The general rule for both: the secret is the credential. There is no account recovery, no second factor and no consent screen between someone holding it and someone using it.
The column worth reading twice is the last one. A link you cannot revoke without help is a link you do not control, and every row above is revocable by you alone.
A short pre-flight, in the order that saves the most trouble.
Link a demo account first. Every platform above offers one. A demo link exercises the entire path — authorisation, symbol mapping, sizing, the first copied trade — against an account where a misconfiguration costs nothing.
Check what the connection is for. A journal needs to read. A copier Follower needs to place orders. A Provider account only needs to be watched. These are different levels of access and there is no reason to grant more than the role needs.
Confirm the server name exactly. More MetaTrader link failures come from the wrong server string than from anything else. Brokers run many servers with near-identical names, and demo and live are always different. Copy it from your terminal rather than typing it.
Know what happens when it breaks. Connections drop. Tokens expire. Brokers do maintenance. What matters is whether you find out: a link that silently stops copying is worse than one that fails loudly, which is why a broken or expired connection surfaces as an explicit reconnect state rather than as an absence of trades.
For MT4 and MT5, yes — those platforms offer no alternative, and any tool that connects to them holds a login. It is encrypted at rest with AES-256-GCM rather than kept in plain text. For cTrader and Tradovate, no: those use OAuth, so you log in on the platform's own site and we receive a revocable token instead of a password.
OAuth keeps the password on the platform's side. You authenticate on their domain, approve a specific grant, and the software receives a token that expires, that is limited to what the grant covered, and that you can revoke from your platform settings. Entering login details hands over a credential that can do everything you can do, until you change it.
For OAuth platforms, remove the authorised application in your cTrader or Tradovate account settings — that ends the grant regardless of what any vendor does. For MT4 and MT5, change the trading password at your broker, which invalidates every stored copy everywhere at once. Deleting the account inside a dashboard is worth doing as well, but it is the weaker of the two steps.
Most often because the refresh chain broke. Changing your platform password, revoking and re-granting access, or a platform-side session expiry all invalidate the refresh token, and the next renewal fails. On MetaTrader, the usual causes are a changed password, a server migration by the broker, or an account that the broker has archived for inactivity.
Usually yes. MetaTrader allows multiple simultaneous logins from different terminals, and OAuth grants are per application so several can coexist. What can conflict is two tools both managing the same positions — two copiers, or a copier and a risk manager that both move stops. Decide which one owns order management and configure the other to read only.
Not for the connection itself, because the relay runs on our infrastructure rather than on your machine, so linked accounts stay connected when your computer is off. A VPS is still relevant if you run your own Expert Advisors or a local terminal that must stay online, since those do depend on a machine being awake.
Once the accounts are linked, what actually happens between a Provider's fill and a Follower's order — the reconcile loop, what it retries, and what it deliberately does not — is the subject of /blog/trade-replication-engine-explained. If your reason for linking is monitoring rather than execution, the read-only path and its honest limits are covered in /blog/what-is-drop-copy.
