Trading 212 API: What You Can (and Can't) Do With It

Auth is Basic, not Bearer

A key is a Key ID + Secret Key pair, generated from the Trading 212 app under Settings → API (Beta). It looks like it should be sent as a bearer token — most third-party examples treat it that way — but the API expects HTTP Basic auth: Key ID as the username, Secret Key as the password, base64-encoded in the Authorization header. A bearer-style request 401s even with correct credentials.

Scopes

Keys are scoped at creation. For read-only portfolio access you only need the portfolio scope — don't grant more than that to a key you're handing to a third-party tool. A key missing the scope a request needs returns 403, not a generic auth failure, which makes it easy to tell apart from a bad credential during setup.

The IP restriction gotcha

Key creation offers an optional IP restriction. It's tempting to turn on for security, but it allowlists a single fixed address — which almost no server-side host has. Vercel, most serverless platforms, and anything behind a load balancer route requests through a rotating pool of addresses, so a restricted key will reject every request from them with a 401 that looks identical to a bad credential, with no separate error to tell you it's the IP rule and not the key itself. Leave the restriction off for anything that isn't running from one static, known address.

The portfolio endpoint

GET /api/v0/equity/portfolio is the lightest real endpoint to both verify a key works and fetch live positions in one call — no separate "whoami" endpoint needed just to check credentials. It returns each holding's ticker, quantity, and current price; tickers come back in a compound form like AAPL_US_EQ or BRK_B_US_EQ rather than a bare symbol, worth normalizing before matching against any other data source (news feeds, other broker APIs) that expects plain tickers.

Rate limits

Trading 212 rate-limits per key; a 429 means back off, not retry immediately. For a single account checked once or a few times a day this is a non-issue — it only starts to matter if you're polling frequently or running the same key across many concurrent requests.

What it doesn't give you

The public API is read-focused around account and portfolio data. It's the right tool for building a tracker, a dashboard, or a sync like this one — not for anything that needs to act on an account. If a tool asks for more than the portfolio scope to show you your own holdings, that's worth questioning before you grant it.