Logo
Help center

Connect a cTrader account

Before the Investion bot can run, you have to connect at least one cTrader account via OAuth. Connecting itself is free and works for both demo and live accounts — what running a live account costs depends on your billing model, covered on /help/billing. This page walks through the connect flow step-by-step + common errors.

This page covers cTrader (forex/CFD) brokers. Connecting a Binance account uses API keys instead of OAuth, and its own errors — covered below.

Already have an account, or not sure yet which broker to use? /dashboard/create-bot walks through market → account → wizard in one flow, connecting a new account along the way if you need one.

Prerequisites

  • An active cTrader (Spotware) account — demo or live, either works.
  • Bot permission enabled in the cTrader app. (Most brokers have this on by default.)
  • You've signed up for Investion + confirmed your email.

Steps

  1. /dashboard/accounts/connect → Connect with cTrader.
  2. Spotware's OAuth page opens. Sign in with your account.
  3. Pick the accounts to authorize → Authorize. cTrader redirects back to investion-web.
  4. In the modal, check the accounts you want to give to the bot → Connect.
  5. The moment you flip the toggle, the engine starts a session within a few seconds.

Common errors

state_mismatch — Cookie loss or tab confusion. Sign in from a single browser, with a single account. If you use a cookie blocker, allow the investion-web domain.

token_exchange_failed — A server-side configuration error. If this keeps happening, contact support.

accounts_write_failed — The account list could not be saved. Contact support if this persists.

ALREADY_LOGGED_IN — The same account is already authenticated in the engine. The auto-starter swallows this silently; nothing changes in practice.

What the account status means

The coloured dot on an account card reflects what the engine last reported about the broker link — independent of the account's own on/off switch.

  • Connected — The Spotware socket is connected and the engine said so within the last minute.
  • Degraded — The link is reconnecting, or no engine has reported for a while (e.g. during a failover) — meaning the link cannot be verified right now.
  • Error — The engine reported a real failure (authorisation / token). You may need to reconnect the account.
  • Link released — The engine deliberately let this account's link go (e.g. a handover).
  • Unknown — Nothing reported yet: the account was just linked, or the page just loaded.

The text next to it is the account's own switch. While it is off, no bot on this account runs even if the link is healthy. Switching the account off also switches its bots off — re-opening the account does not start them again; you turn each one back on yourself.

Hedging or netting

Your broker sets this when the account is created — it is not something you switch per trade, and it decides how positions are kept:

  • Hedging — each order gets its own position. A long and a short can sit on the same symbol at once, and a martingale chain's rungs stay separate, each with its own entry and take profit.
  • Netting — one position per symbol. An order in the opposite direction reduces or closes what is already there instead of opening a new one, and orders in the same direction merge into a single position at an averaged price.

It matters here because this platform's bot works in chains of separate positions. On a hedging account that maps onto what the broker holds. On a netting account the broker merges them, so what the bot tracks and what your account actually holds can diverge — which is why the wizard warns before a second trading bot lands on a symbol you are already trading.

The account page shows which one you have, next to the currency and leverage. It appears once the engine has connected to the account and the broker has told us — before that it is simply absent rather than guessed at. Most retail cTrader accounts hedge; if yours nets, tell us before running more than one bot on a symbol.

Remove an account

On an account's detail page, Settings → Remove account. The bot stops immediately, trade history is kept. To reconnect, run the Connect flow again.

Connecting Binance (crypto)

Binance has no OAuth to authorize through, so you paste an API key and secret instead, on /dashboard/accounts/connect. Choose Testnet or Live when you connect — reconnecting the same one later replaces the existing key rather than adding a second.

Prerequisites (Binance)

  • Futures trading enabled on the key — the bot trades futures, not spot.
  • Withdrawals permission turned OFF on the key. This isn't a suggestion — a key with withdrawal rights is refused outright and never stored.
  • No IP allowlist on the key. The engine has no fixed outbound IP, so a pinned key would stop working without warning.
  • Your account must be in Classic mode, not Portfolio Margin. Binance removes the Futures permission from every API key while Portfolio Margin is on, so that account can't be connected until it's switched back.

Steps — Testnet (practice funds)

  1. Register or log in at testnet.binancefuture.com — a separate system from your real Binance account, with its own practice balance.
  2. Find the “API Key” section on the testnet dashboard and generate a key. Testnet doesn't ask for permissions; a testnet key can already do everything testnet allows.
  3. Copy the API Key and Secret Key now — the secret is shown once.
  4. Paste both into /dashboard/accounts/connect with Testnet selected.

Steps — Live (real funds)

  1. Log in at binance.com with your real account.
  2. Confirm the account is in Classic mode, not Portfolio Margin (check the Wallet overview). If Portfolio Margin is on, switch it back or use a different Classic account first — otherwise Binance will not let the key hold Futures permission at all.
  3. If Futures has never been opened on this account, open it once from Binance's top menu and accept the first-time agreement. This activates the Futures wallet the API reads from.
  4. Go to API Management (avatar menu → API Management) and create a new HMAC key (not Ed25519).
  5. Enable ONLY “Enable Reading” and “Enable Futures” on the key. Leave withdrawals and everything else off.
  6. Set “IP access restrictions” to Unrestricted — the engine has no single fixed outbound IP, so a pinned key stops working silently.
  7. Save, copy the Secret Key immediately (shown once), then paste both into /dashboard/accounts/connect with Live selected.

Common errors (Binance)

key_rejected — Binance itself rejected the key on the futures call (wrong key/secret, or futures isn't enabled for it). Double-check the key on Binance's side.

withdrawals_enabled — Refused before the key is ever stored: it has withdrawal permission on, which this platform never accepts. Turn withdrawals off for the key on Binance and try again.

venue_blocked — Binance refused the verification request itself, before your key was examined at all — unrelated to whether your key is valid. Try again in a moment.

venue_unreachable / venue_timeout — Binance, or the connection to it, didn't answer in time. Try again.

permissions_unreadable — The key's permissions couldn't be confirmed. Try again, or check the key's permissions directly on Binance.

Testnet keys can't be permission-checked the same way — Binance's testnet has no wallet API to ask. That's expected, not an error; a testnet connection just never shows as "verified" the way a live one does, since it can't move real money either way.

Controls on this step

What the app checks before letting you continue, and why.

  • Live account confirmation — The first time you activate a live account, you must confirm — real money is at risk from that point on. Demo accounts skip this.