IG Authentication: API Access and Security (2026)

Authentication overview

The IG API provides programmatic access to trading functionality, market data, and account management. Authentication for the IG API is primarily session-based, designed to secure user accounts and trading activities. This model requires developers to first obtain a unique Client API Key from their IG account. This key, in conjunction with a user's IG username and password, is used to initiate an authentication request. Upon successful authentication, the API returns a session token, which must then be included in the headers of all subsequent API requests for the duration of the session. This mechanism ensures that each request is authorized and linked to an active user session, protecting against unauthorized access to trading accounts and sensitive financial data.

The IG API adheres to standard web security practices, utilizing HTTPS for all communication to encrypt data in transit and prevent eavesdropping or tampering. This secure communication channel is crucial for transmitting sensitive information such as login credentials and trading instructions. Developers interacting with the IG API should be familiar with RESTful API principles and secure coding practices to implement authentication correctly and maintain the integrity of their applications.

Supported authentication methods

The IG API primarily supports a session-based authentication flow for its RESTful services. This method leverages a combination of a static Client API Key and dynamic session tokens to authenticate user requests.

Client API Key + Session Token

This is the standard authentication method for the IG REST API. It involves a two-step process:

1. Obtain a Client API Key: This is a persistent key generated within your IG account. It identifies your application or integration with IG.
2. Establish a Session: Using your Client API Key, IG username, and password, you make an initial login request to the API. If successful, the API returns two key headers: X-IG-CST (Client Session Token) and X-SECURITY-TOKEN (Account Session Token). These tokens represent your active session.

All subsequent API calls must include both the X-IG-CST and X-SECURITY-TOKEN headers, along with your Client API Key. The session tokens have a limited lifespan and must be refreshed or a new session established once they expire. This approach, similar to patterns described in general API security guides, provides a robust method for authenticating continuous interactions without re-transmitting primary credentials on every request, as explained in the IG Platform Glossary.

Two-Factor Authentication (2FA)

While 2FA is not directly used for authenticating individual API requests, it is a critical security feature for accessing your IG account itself. Enabling 2FA on your IG account adds an extra layer of security, requiring a second verification method (e.g., a code from a mobile authenticator app) in addition to your password during login. This protects your account from unauthorized access even if your password is compromised. Although the API authentication flow itself doesn't directly prompt for 2FA, securing your primary IG account with it is a fundamental best practice that indirectly enhances the security of any associated API access.

Getting your credentials

To begin using the IG API, you need to obtain specific credentials from your IG account. The primary credential is the Client API Key, which acts as your application's identifier.

Client API Key

Follow these steps to generate your Client API Key:

1. Log in to your IG account via the web platform.
2. Navigate to the 'My Account' section.
3. Look for 'Settings' or 'Trading Settings'.
4. Find the 'API Keys' section. Here, you will have the option to generate a new API Key.
5. Once generated, copy and securely store this key. It will be a long alphanumeric string.

It is important to treat your Client API Key with the same level of security as your password. Do not embed it directly in client-side code or publicly accessible repositories. For more details on API access, refer to the IG REST API Reference.

Username and Password

Your standard IG account username and password are required for the initial login request to establish a session. These are the same credentials you use to log in to the IG web platform or mobile applications.

Sandbox Environment

IG provides a sandbox environment for testing your API integrations without risking real capital. It is highly recommended to develop and test your applications in the sandbox before deploying them to the live environment. You will need a separate sandbox account and corresponding credentials for this environment, which can often be created through the same API Keys section or a dedicated developer portal.

Authenticated request example

This example demonstrates the typical two-step process for making an authenticated request to the IG API: first, logging in to obtain session tokens, and then using those tokens to make a subsequent data request.

Step 1: Login and obtain session tokens

This request uses your Client API Key, username, and password to establish a session. The response will include your session tokens in the headers.

POST /api/v1/session HTTP/1.1
Host: demo-api.ig.com
X-IG-API-KEY: YOUR_CLIENT_API_KEY
Content-Type: application/json; charset=UTF-8
Accept: application/json; charset=UTF-8

{
  "identifier": "YOUR_USERNAME",
  "password": "YOUR_PASSWORD",
  "encryptedPassword": false
}

A successful response will include headers like X-IG-CST and X-SECURITY-TOKEN. You must extract these for subsequent requests.

Step 2: Make an authenticated request (e.g., get account details)

Once you have the session tokens, you can include them in the headers of any subsequent API call. This example fetches account details.

GET /api/v1/accounts HTTP/1.1
Host: demo-api.ig.com
X-IG-API-KEY: YOUR_CLIENT_API_KEY
X-IG-CST: YOUR_CLIENT_SESSION_TOKEN
X-SECURITY-TOKEN: YOUR_ACCOUNT_SESSION_TOKEN
Accept: application/json; charset=UTF-8

The response will contain your account information, demonstrating successful authentication. Remember to replace placeholder values with your actual credentials and tokens. The full list of available API endpoints is detailed in the IG API Reference Documentation.

Security best practices

Adhering to security best practices is crucial when integrating with the IG API, especially given the financial nature of the platform. Protecting your credentials and user data should be a top priority.

Secure Handling of Credentials

• Never hardcode credentials: Avoid embedding your Client API Key, username, or password directly into your application's source code. Use environment variables, secure configuration files, or a secrets management service to store and retrieve them.
• Protect API Keys: Treat your Client API Key like a password. Do not expose it publicly (e.g., in client-side code, public GitHub repositories, or client logs).
• Encrypt stored credentials: If credentials must be stored (e.g., for automated processes), ensure they are encrypted at rest using strong encryption algorithms.

Session Management

• Manage session tokens securely: Session tokens (X-IG-CST and X-SECURITY-TOKEN) should be stored securely and transmitted only over HTTPS. Avoid storing them in insecure client-side storage like local storage, which is vulnerable to XSS attacks.
• Handle session expiry: The IG API session tokens have a limited lifespan. Your application should be designed to gracefully handle session expiry, either by re-authenticating or refreshing the session as per the API's guidelines.
• Invalidate sessions: If an application detects suspicious activity or a user logs out, it should explicitly invalidate the session via the API's logout endpoint.

Application Security

• Use HTTPS exclusively: Always communicate with the IG API over HTTPS to ensure all data in transit is encrypted. The IG API enforces this, but it's a fundamental principle for any secure web communication. This is a general principle for all APIs, as highlighted by Mozilla's web security documentation.
• Implement robust input validation: Validate all user inputs and data sent to the API to prevent injection attacks and ensure data integrity.
• Error handling and logging: Implement comprehensive error handling and logging, but be careful not to log sensitive information (like credentials or full session tokens) in plain text.
• Regular security audits: Periodically review your application's code and infrastructure for potential security vulnerabilities.

User Account Security

• Enable Two-Factor Authentication (2FA): Encourage or enforce 2FA for your IG account login. While it doesn't directly secure API calls, it significantly protects the underlying account from which API keys are generated.
• Strong, unique passwords: Use strong, unique passwords for your IG account that are not reused across other services.
• Least privilege principle: If possible, configure API access with the minimum necessary permissions required for your application's functionality.