API security for stock brokers and trading platforms became a hard requirement when SEBI’s algo-trading framework turned mandatory. This guide explains the controls every broker API must enforce, why traceability matters, and how to meet the bar without a large security team.
TL;DR
API security for brokers and trading platforms is now governed by SEBI’s algo-trading framework, mandatory from April 2026, on top of the CSCRF API expectations. The core controls are Algo ID tagging on every algorithmic order, static IP whitelisting, rate and orders-per-second limits, two-factor authentication for API sessions, encryption, and a full audit trail that ties every order to a real user. The goal is a traceable, rate-controlled, authenticated API where no order is anonymous.
On this page
Why API security for stock brokers changed
As retail algorithmic trading exploded, broker APIs became the channel through which orders are placed, modified, and cancelled at machine speed, and a prime target for abuse and instability. In response, the Securities and Exchange Board of India, with the exchanges, built a framework that became mandatory for all stock brokers from April 2026. Combined with the CSCRF expectations for API security in the securities market, this turned API security for stock brokers and trading platforms from a design preference into a hard, audited obligation. Every order that flows through a broker API now has to be authenticated, rate-controlled, and traceable to a real identity.
The six core controls
The rules are detailed, but strong API security comes down to a recognisable set of controls that every broker and trading platform needs working and evidenced.
In practice that means tagging every algorithmic order with a unique, exchange-assigned Algo ID, whitelisting static client IP addresses and blocking dynamic or non-whitelisted ones, enforcing rate limits and an orders-per-second cap on order-placement APIs, requiring two-factor authentication such as an OAuth flow with a time-based one-time password for API sessions, encrypting submissions with proper access control, and maintaining an audit trail that identifies the actual user behind every order. A structured VAPT programme across these APIs is the fastest way to prove the controls hold.
Traceability from user to exchange
The controls are not independent, they form a chain. Understanding that chain is the clearest way to see what the framework is really asking for.
An order starts from a user or an algo on a whitelisted static IP, authenticated with two factors. It passes through the broker API, where it is rate-limited and tagged with its Algo ID. It reaches the exchange, which monitors order behaviour in real time. And it lands in an audit trail that records the identity, the user-id, and the timestamp. This closed loop is the point of the framework: every API call and order can be traced to its origin, which is the foundation of the whole framework.
Rate limits and the OPS threshold
Rate control deserves its own attention, because it changes a client’s obligations, not just the technical limits.
Order-placement APIs carry per-second, per-minute, and per-window limits enforced per user. The orders-per-second threshold matters most: a client trading below roughly ten orders per second is treated as a regular API user, while crossing it moves them into registered-algo territory, requiring an Algo ID and additional compliance scrutiny. For a broker, enforcing these limits reliably, and distinguishing normal use from abusive bursts, is a core part of the requirement, and a common point of failure during volatile market periods.
Testing your trading API
Because these APIs move money and orders at speed, testing them is not optional. Strong broker API security means regular vulnerability assessment and penetration testing focused on the API layer, where broken authentication, weak session handling, missing rate limits, and business-logic flaws tend to hide. An automated scan alone will not find the logic issues that matter in a trading API, our guide on VAPT versus vulnerability scanning explains why skilled, human-led testing is what an audit and a real attacker both demand.
The lean-team path to API security for stock brokers
Meeting all of this, authentication, rate control, traceability, encryption, and ongoing API testing with audit-ready evidence, is a heavy lift for a broking or trading-platform team without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is one platform that runs the testing and organises the evidence together.
Get API security for stock brokers right, and audit-ready.
Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean trading teams. Test your trading APIs, harden authentication and rate control, and keep audit-ready evidence, on one platform. No security team required.
Book a Demo →Frequently asked questions
What is API security for stock brokers?
It is the set of controls SEBI and the exchanges require on broker and trading-platform APIs: Algo ID tagging, static IP whitelisting, rate and orders-per-second limits, two-factor authentication, encryption, and an audit trail tying every order to a real user. It became mandatory for all brokers from April 2026.
What is Algo ID tagging?
Every algorithmic order must carry a unique, exchange-assigned Algo ID, whether it comes from a broker, a third-party provider, or a self-built strategy. It lets exchanges track order behaviour in real time and ties each order to its origin.
Do broker APIs need static IP whitelisting?
Yes. Brokers must block API requests from dynamic or non-whitelisted IPs. Clients provide one or more static IP addresses that the broker whitelists, which is a core part of API security for stock brokers.
What are the rate limits for trading APIs?
Order-placement APIs carry per-second, per-minute, and per-window limits enforced per user. The orders-per-second threshold, around ten, is significant: crossing it moves a client into registered-algo territory with an Algo ID and extra scrutiny.
Is two-factor authentication required for trading APIs?
Yes. Trading APIs require multi-factor authentication, typically an OAuth flow with a time-based one-time password for session initiation, in line with SEBI’s authentication expectations for automated trading.
How should a broker test its trading API?
With regular vulnerability assessment and penetration testing focused on the API layer, covering authentication, session handling, rate limiting, and business-logic flaws. An automated scan alone is not enough, human-led testing is what an audit and a real attacker both require.