Run your own bot on your own account.

1. In the client portal, find the trading account you want your bot to use and click Trade on its account card. This opens the Web Trader, signed in automatically — no separate login.
2. In the Web Trader, click your avatar in the top-right corner to open the profile menu, then choose API Access. This opens the API Access modal, with a tokens table and a Generate Token button.
3. Click Generate Token. On General Information, name the token, optionally tick Used via MCP (AI assistant), choose the trading account (each token works on exactly one account, and this can't be changed later), and pick an expiry: 30 days (default), 90 days, 6 months, 1 year (maximum), or a custom date. Keep it short — the 30-day default is a good choice unless you need longer.
4. On Access, choose the permissions the token gets — full access, read-only, or a custom selection per resource (account info, positions, orders, history, and so on). Grant only what your bot needs; start read-only.
5. Copy the token immediately — it's shown once, at creation. After that, the tokens table only ever shows a masked version of it.
6. Store it as an environment variable for your bot to read. Never paste it into your bot's code, a commit, a screenshot, or a support chat.

The same API Access modal also shows the Trader API base URL (https://trader-api.match-trader.com, with an API Documentation link next to it), an MCP server URL (https://mcp.match-trader.com/mcp, with a Copy configuration button) for AI assistants, and a table of your existing tokens, masked, where you can revoke any of them.

import os
import requests

TOKEN = os.environ["TRADER_API_TOKEN"]  # never hardcode this
BASE_URL = os.environ.get("TRADER_API_BASE_URL", "https://trader-api.match-trader.com")
HEADERS = {"Authorization": f"Bearer {TOKEN}"}

account = requests.get(f"{BASE_URL}/v1/account", headers=HEADERS, timeout=10)
account.raise_for_status()
print(account.json())  # login, accountType (REAL/DEMO), currency, leverage, accessRight, ...

positions = requests.get(f"{BASE_URL}/v1/positions", headers=HEADERS, timeout=10)
positions.raise_for_status()
print(positions.json())  # open positions on this account, with live P&L

That's it for reading. Placing an order follows the same pattern with a POST and a JSON body — see the downloadable samples below for a complete, tested version with error handling and a demo-only safety guard.

There are no deposit or withdrawal endpoints — a Trader API token can never move money in or out of your account, whatever permissions you grant it. Every request needs a valid, unexpired, unrevoked token with the right permission for that call, or it's rejected before anything happens.

The Trader API is REST only — there is no streaming, so your bot has to poll. A quote request roughly every 2–3 seconds per account leaves comfortable headroom under the 60/min quote limit; polling faster than that eats into the budget your order calls also share. Every response includes X-RateLimit-Remaining-Endpoint and X-RateLimit-Remaining-Global headers so your bot can see how much headroom is left. Go over either limit and you get 429 Too Many Requests with a Retry-After header telling you how many seconds to wait — have your bot sleep that long and retry, with a sane cap on total retries, rather than hammering the endpoint.

1. When generating the token, tick Used via MCP (AI assistant), choose minimal permissions (start read-only), a short expiry, and ideally a demo account.
2. Use the Copy configuration button in the API Access modal to get the MCP server config (server URL https://mcp.match-trader.com/mcp) and add it to your AI assistant's MCP settings. The token itself isn't part of that config — supply it separately as an Authorization: Bearer <token> header, kept in the assistant's secret or environment store, never pasted into a chat prompt or a shared file.
3. From there, the assistant can act on that one trading account, limited to the permissions you granted the token — and its calls share that account's rate limit with everything else using the token. Revoke the token in the API Access modal when you're done.