API Security for Stock Brokers: 6 Critical Rules | Osto<\/title>\n<meta name=\"description\" content=\"API security for stock brokers and trading platforms explained: Algo ID tagging, static IP whitelisting, rate limits, two-factor auth, and audit trails.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">API security for stock brokers and trading platforms became a hard requirement when SEBI\u2019s algo-trading framework turned mandatory. This guide explains the controls every broker API must enforce, why traceability matters, and how to meet the bar without a large security team.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>API security for brokers and trading platforms is now governed by SEBI\u2019s algo-trading framework, mandatory from April 2026, on top of the CSCRF API expectations. The core controls are Algo ID tagging on every algorithmic order, static IP whitelisting, rate and orders-per-second limits, two-factor authentication for API sessions, encryption, and a full audit trail that ties every order to a real user. The goal is a traceable, rate-controlled, authenticated API where no order is anonymous.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why broker API security changed<\/a><\/li>\n <li><a href=\"#controls\">The six core controls<\/a><\/li>\n <li><a href=\"#trace\">Traceability end to end<\/a><\/li>\n <li><a href=\"#ops\">Rate limits and OPS<\/a><\/li>\n <li><a href=\"#test\">Testing your API<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">Why API security for stock brokers changed<\/h2>\n <p>As retail algorithmic trading exploded, broker APIs became the channel through which orders are placed, modified, and cancelled at machine speed, and a prime target for abuse and instability. In response, the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a>, with the exchanges, built a framework that became mandatory for all stock brokers from April 2026. Combined with the CSCRF expectations for API security in the securities market, this turned API security for stock brokers and trading platforms from a design preference into a hard, audited obligation. Every order that flows through a broker API now has to be authenticated, rate-controlled, and traceable to a real identity.<\/p>\n\n <h2 class=\"sec\" id=\"controls\">The six core controls<\/h2>\n <p>The rules are detailed, but strong API security comes down to a recognisable set of controls that every broker and trading platform needs working and evidenced.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The controls<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the rules now require<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">API security for the broking and trading world is now shaped by SEBI\u2019s algo-trading framework and the CSCRF API expectations. Six controls carry most of the weight, and together they make every API order safe and traceable.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core API security controls for stock brokers and trading platforms\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core trading API security controls<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M3 12l9-9h7v7l-9 9z\"\/><circle cx=\"15.5\" cy=\"8.5\" r=\"1.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Algo ID tagging<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Every algo order carries a<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">unique ID<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"6\" width=\"18\" height=\"12\" rx=\"2\"\/><path d=\"M7 10v4M11 10v4M11 10h1.5a1.5 1.5 0 0 1 0 3H11M15 10h3M16.5 10v4\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Static IP whitelisting<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Block non-whitelisted and<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">dynamic IPs<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 18a8 8 0 1 1 16 0\"\/><path d=\"M12 18l4-5\"\/><circle cx=\"12\" cy=\"18\" r=\"1.4\" fill=\"currentColor\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Rate and OPS limits<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cap orders per second and per<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">window<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 11a3 3 0 0 1 6 0c0 4-1 6-1 6M8 12c0 5 1 7 1 7M12 11v6M15.5 9.5a5 5 0 0 0-8 1.5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Two-factor auth<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">OAuth and TOTP for API sessions<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Audit trail<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Trace every order to a real user<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Encryption<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Encrypted submissions and access<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">control<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means tagging every algorithmic order with a unique, exchange-assigned Algo ID, whitelisting static client IP addresses and blocking dynamic or non-whitelisted ones, enforcing rate limits and an orders-per-second cap on order-placement APIs, requiring two-factor authentication such as an OAuth flow with a time-based one-time password for API sessions, encrypting submissions with proper access control, and maintaining an audit trail that identifies the actual user behind every order. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> across these APIs is the fastest way to prove the controls hold.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">No order can be anonymous<\/div>The unifying idea behind broker API security is traceability. Algo ID tagging, static IPs, and audit trails all exist so that every single order can be tied to a specific user, strategy, and timestamp. An API that cannot do that will not pass an exchange or SEBI review.<\/div>\n\n <h2 class=\"sec\" id=\"trace\">Traceability from user to exchange<\/h2>\n <p>The controls are not independent, they form a chain. Understanding that chain is the clearest way to see what the framework is really asking for.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Traceability<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Every order tied to a real identity<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The framework builds a closed-loop chain from the user or algo through the broker API to the exchange, with an audit trail at the end. This traceability is the backbone of the framework.<\/div>\n <svg viewBox=\"0 0 800 214\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How a trading API order is traced from user to exchange\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Every API order must be traceable end to end<\/text>\n <rect x=\"24\" y=\"70\" width=\"150\" height=\"90\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"99\" y=\"104\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\">User \/ Algo<\/text>\n <text x=\"99\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Static IP,<\/text><text x=\"99\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">2FA session<\/text>\n <g transform=\"translate(180,108)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"2.4\" stroke-linecap=\"round\"><path d=\"M0 7h24M18 1l6 6-6 6\"\/><\/g>\n <rect x=\"212\" y=\"70\" width=\"150\" height=\"90\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"287\" y=\"104\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\">Broker API<\/text>\n <text x=\"287\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Rate limits,<\/text><text x=\"287\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Algo ID tag<\/text>\n <g transform=\"translate(368,108)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"2.4\" stroke-linecap=\"round\"><path d=\"M0 7h24M18 1l6 6-6 6\"\/><\/g>\n <rect x=\"400\" y=\"70\" width=\"150\" height=\"90\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"475\" y=\"104\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\">Exchange<\/text>\n <text x=\"475\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Real-time<\/text><text x=\"475\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">monitoring<\/text>\n <g transform=\"translate(556,108)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2.4\" stroke-linecap=\"round\"><path d=\"M0 7h24M18 1l6 6-6 6\"\/><\/g>\n <rect x=\"588\" y=\"70\" width=\"188\" height=\"90\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"682\" y=\"104\" text-anchor=\"middle\" fill=\"#0a6558\" font-size=\"13\" font-weight=\"800\">Audit trail<\/text>\n <text x=\"682\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Every order tied to a<\/text><text x=\"682\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">real user and user-id<\/text>\n <text x=\"400\" y=\"192\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">A closed-loop chain: order, identity, and timestamp are all recorded<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>An order starts from a user or an algo on a whitelisted static IP, authenticated with two factors. It passes through the broker API, where it is rate-limited and tagged with its Algo ID. It reaches the exchange, which monitors order behaviour in real time. And it lands in an audit trail that records the identity, the user-id, and the timestamp. This closed loop is the point of the framework: every API call and order can be traced to its origin, which is the foundation of the whole framework.<\/p>\n\n <h2 class=\"sec\" id=\"ops\">Rate limits and the OPS threshold<\/h2>\n <p>Rate control deserves its own attention, because it changes a client\u2019s obligations, not just the technical limits.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Rate control<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Limits scale with the order rate<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Order-placement APIs are rate-limited, and crossing the orders-per-second threshold shifts a client into registered-algo territory with heavier obligations. Getting this right is central to broker API security.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How order-per-second thresholds change broker API obligations\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Rate limits change with the order rate<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"60\" y=\"100\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Below the OPS threshold<\/text>\n <line x1=\"60\" y1=\"112\" x2=\"356\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"60\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Under about 10 orders per<\/text>\n <text x=\"60\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">second: treated as a regular<\/text>\n <text x=\"60\" y=\"178\" fill=\"#4a5170\" font-size=\"12\">API user, no algo registration.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"450\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Above the threshold<\/text>\n <line x1=\"450\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"450\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Higher order rates require algo<\/text>\n <text x=\"450\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">registration, an Algo ID, and<\/text>\n <text x=\"450\" y=\"178\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">extra compliance scrutiny.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Order-placement APIs carry per-second, per-minute, and per-window limits enforced per user. The orders-per-second threshold matters most: a client trading below roughly ten orders per second is treated as a regular API user, while crossing it moves them into registered-algo territory, requiring an Algo ID and additional compliance scrutiny. For a broker, enforcing these limits reliably, and distinguishing normal use from abusive bursts, is a core part of the requirement, and a common point of failure during volatile market periods.<\/p>\n\n <h2 class=\"sec\" id=\"test\">Testing your trading API<\/h2>\n <p>Because these APIs move money and orders at speed, testing them is not optional. Strong broker API security means regular vulnerability assessment and penetration testing focused on the API layer, where broken authentication, weak session handling, missing rate limits, and business-logic flaws tend to hide. An automated scan alone will not find the logic issues that matter in a trading API, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why skilled, human-led testing is what an audit and a real attacker both demand.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Reliability is now part of compliance<\/div>For a trading platform, uptime and security are intertwined. Dropped connections and delayed order updates during volatile periods are not just a user-experience problem, they signal weak API controls. SEBI\u2019s framework treats robust, tested, rate-controlled APIs as a compliance obligation, not just an engineering goal.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to API security for stock brokers<\/h2>\n <p>Meeting all of this, authentication, rate control, traceability, encryption, and ongoing API testing with audit-ready evidence, is a heavy lift for a broking or trading-platform team without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is one platform that runs the testing and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean trading teams. It runs VAPT across your trading APIs and platform, checks for the authentication, session, and business-logic flaws that hit order-placement APIs, supports encryption and monitoring, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, DPDP, and 200+ frameworks on one platform. Meeting this bar, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Get API security for stock brokers right, and audit-ready.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean trading teams. Test your trading APIs, harden authentication and rate control, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is API security for stock brokers?<\/summary><p>It is the set of controls SEBI and the exchanges require on broker and trading-platform APIs: Algo ID tagging, static IP whitelisting, rate and orders-per-second limits, two-factor authentication, encryption, and an audit trail tying every order to a real user. It became mandatory for all brokers from April 2026.<\/p><\/details>\n <details><summary>What is Algo ID tagging?<\/summary><p>Every algorithmic order must carry a unique, exchange-assigned Algo ID, whether it comes from a broker, a third-party provider, or a self-built strategy. It lets exchanges track order behaviour in real time and ties each order to its origin.<\/p><\/details>\n <details><summary>Do broker APIs need static IP whitelisting?<\/summary><p>Yes. Brokers must block API requests from dynamic or non-whitelisted IPs. Clients provide one or more static IP addresses that the broker whitelists, which is a core part of API security for stock brokers.<\/p><\/details>\n <details><summary>What are the rate limits for trading APIs?<\/summary><p>Order-placement APIs carry per-second, per-minute, and per-window limits enforced per user. The orders-per-second threshold, around ten, is significant: crossing it moves a client into registered-algo territory with an Algo ID and extra scrutiny.<\/p><\/details>\n <details><summary>Is two-factor authentication required for trading APIs?<\/summary><p>Yes. Trading APIs require multi-factor authentication, typically an OAuth flow with a time-based one-time password for session initiation, in line with SEBI\u2019s authentication expectations for automated trading.<\/p><\/details>\n <details><summary>How should a broker test its trading API?<\/summary><p>With regular vulnerability assessment and penetration testing focused on the API layer, covering authentication, session handling, rate limiting, and business-logic flaws. An automated scan alone is not enough, human-led testing is what an audit and a real attacker both require.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>API Security for Stock Brokers: 6 Critical Rules | Osto API security for stock brokers and trading platforms became a\u2026<\/p>\n","protected":false},"author":8,"featured_media":1266,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[655,656],"class_list":["post-1265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-api-security-for-stock-brokers","tag-trading-api-security"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1265"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1265\/revisions"}],"predecessor-version":[{"id":1267,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1265\/revisions\/1267"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1266"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1265,"date":"2026-09-14T13:06:29","date_gmt":"2026-09-14T13:06:29","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1265"},"modified":"2026-09-14T13:06:29","modified_gmt":"2026-09-14T13:06:29","slug":"api-security-for-stock-brokers","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/api-security-for-stock-brokers\/","title":{"rendered":"API Security for Stock Brokers and Trading Platforms: A Complete Guide"},"content":{"rendered":"\n\n\n\n\n\nAPI Security for Stock Brokers: 6 Critical Rules | Osto<\/title>\n<meta name=\"description\" content=\"API security for stock brokers and trading platforms explained: Algo ID tagging, static IP whitelisting, rate limits, two-factor auth, and audit trails.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">API security for stock brokers and trading platforms became a hard requirement when SEBI\u2019s algo-trading framework turned mandatory. This guide explains the controls every broker API must enforce, why traceability matters, and how to meet the bar without a large security team.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>SEBI Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>API security for brokers and trading platforms is now governed by SEBI\u2019s algo-trading framework, mandatory from April 2026, on top of the CSCRF API expectations. The core controls are Algo ID tagging on every algorithmic order, static IP whitelisting, rate and orders-per-second limits, two-factor authentication for API sessions, encryption, and a full audit trail that ties every order to a real user. The goal is a traceable, rate-controlled, authenticated API where no order is anonymous.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">Why broker API security changed<\/a><\/li>\n <li><a href=\"#controls\">The six core controls<\/a><\/li>\n <li><a href=\"#trace\">Traceability end to end<\/a><\/li>\n <li><a href=\"#ops\">Rate limits and OPS<\/a><\/li>\n <li><a href=\"#test\">Testing your API<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">Why API security for stock brokers changed<\/h2>\n <p>As retail algorithmic trading exploded, broker APIs became the channel through which orders are placed, modified, and cancelled at machine speed, and a prime target for abuse and instability. In response, the <a href=\"https:\/\/www.sebi.gov.in\/\" target=\"_blank\" rel=\"noopener\">Securities and Exchange Board of India<\/a>, with the exchanges, built a framework that became mandatory for all stock brokers from April 2026. Combined with the CSCRF expectations for API security in the securities market, this turned API security for stock brokers and trading platforms from a design preference into a hard, audited obligation. Every order that flows through a broker API now has to be authenticated, rate-controlled, and traceable to a real identity.<\/p>\n\n <h2 class=\"sec\" id=\"controls\">The six core controls<\/h2>\n <p>The rules are detailed, but strong API security comes down to a recognisable set of controls that every broker and trading platform needs working and evidenced.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">The controls<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What the rules now require<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">API security for the broking and trading world is now shaped by SEBI\u2019s algo-trading framework and the CSCRF API expectations. Six controls carry most of the weight, and together they make every API order safe and traceable.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The core API security controls for stock brokers and trading platforms\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The core trading API security controls<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M3 12l9-9h7v7l-9 9z\"\/><circle cx=\"15.5\" cy=\"8.5\" r=\"1.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Algo ID tagging<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Every algo order carries a<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">unique ID<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"6\" width=\"18\" height=\"12\" rx=\"2\"\/><path d=\"M7 10v4M11 10v4M11 10h1.5a1.5 1.5 0 0 1 0 3H11M15 10h3M16.5 10v4\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Static IP whitelisting<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Block non-whitelisted and<\/text><text x=\"394\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">dynamic IPs<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 18a8 8 0 1 1 16 0\"\/><path d=\"M12 18l4-5\"\/><circle cx=\"12\" cy=\"18\" r=\"1.4\" fill=\"currentColor\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Rate and OPS limits<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Cap orders per second and per<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">window<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 11a3 3 0 0 1 6 0c0 4-1 6-1 6M8 12c0 5 1 7 1 7M12 11v6M15.5 9.5a5 5 0 0 0-8 1.5\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Two-factor auth<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">OAuth and TOTP for API sessions<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M6 3h8l4 4v14a1 1 0 0 1-1 1H6a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1z\"\/><path d=\"M14 3v4h4\"\/><path d=\"M8 13h8M8 16h5\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Audit trail<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Trace every order to a real user<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#2b3596\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"4.5\" y=\"10.5\" width=\"15\" height=\"9.5\" rx=\"2\"\/><path d=\"M8 10.5V7a4 4 0 0 1 8 0v3.5\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Encryption<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Encrypted submissions and access<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">control<\/text><\/svg>\n \n<\/div>\n\n <p>In practice that means tagging every algorithmic order with a unique, exchange-assigned Algo ID, whitelisting static client IP addresses and blocking dynamic or non-whitelisted ones, enforcing rate limits and an orders-per-second cap on order-placement APIs, requiring two-factor authentication such as an OAuth flow with a time-based one-time password for API sessions, encrypting submissions with proper access control, and maintaining an audit trail that identifies the actual user behind every order. A structured <a href=\"https:\/\/www.osto.one\/resources\/blog\/types-of-vapt\/\">VAPT programme<\/a> across these APIs is the fastest way to prove the controls hold.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">No order can be anonymous<\/div>The unifying idea behind broker API security is traceability. Algo ID tagging, static IPs, and audit trails all exist so that every single order can be tied to a specific user, strategy, and timestamp. An API that cannot do that will not pass an exchange or SEBI review.<\/div>\n\n <h2 class=\"sec\" id=\"trace\">Traceability from user to exchange<\/h2>\n <p>The controls are not independent, they form a chain. Understanding that chain is the clearest way to see what the framework is really asking for.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Traceability<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Every order tied to a real identity<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The framework builds a closed-loop chain from the user or algo through the broker API to the exchange, with an audit trail at the end. This traceability is the backbone of the framework.<\/div>\n <svg viewBox=\"0 0 800 214\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How a trading API order is traced from user to exchange\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Every API order must be traceable end to end<\/text>\n <rect x=\"24\" y=\"70\" width=\"150\" height=\"90\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"99\" y=\"104\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\">User \/ Algo<\/text>\n <text x=\"99\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Static IP,<\/text><text x=\"99\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">2FA session<\/text>\n <g transform=\"translate(180,108)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"2.4\" stroke-linecap=\"round\"><path d=\"M0 7h24M18 1l6 6-6 6\"\/><\/g>\n <rect x=\"212\" y=\"70\" width=\"150\" height=\"90\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"287\" y=\"104\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\">Broker API<\/text>\n <text x=\"287\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Rate limits,<\/text><text x=\"287\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Algo ID tag<\/text>\n <g transform=\"translate(368,108)\" fill=\"none\" stroke=\"#3a46c0\" stroke-width=\"2.4\" stroke-linecap=\"round\"><path d=\"M0 7h24M18 1l6 6-6 6\"\/><\/g>\n <rect x=\"400\" y=\"70\" width=\"150\" height=\"90\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"475\" y=\"104\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"13\" font-weight=\"800\">Exchange<\/text>\n <text x=\"475\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Real-time<\/text><text x=\"475\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">monitoring<\/text>\n <g transform=\"translate(556,108)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2.4\" stroke-linecap=\"round\"><path d=\"M0 7h24M18 1l6 6-6 6\"\/><\/g>\n <rect x=\"588\" y=\"70\" width=\"188\" height=\"90\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"682\" y=\"104\" text-anchor=\"middle\" fill=\"#0a6558\" font-size=\"13\" font-weight=\"800\">Audit trail<\/text>\n <text x=\"682\" y=\"126\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">Every order tied to a<\/text><text x=\"682\" y=\"140\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">real user and user-id<\/text>\n <text x=\"400\" y=\"192\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">A closed-loop chain: order, identity, and timestamp are all recorded<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>An order starts from a user or an algo on a whitelisted static IP, authenticated with two factors. It passes through the broker API, where it is rate-limited and tagged with its Algo ID. It reaches the exchange, which monitors order behaviour in real time. And it lands in an audit trail that records the identity, the user-id, and the timestamp. This closed loop is the point of the framework: every API call and order can be traced to its origin, which is the foundation of the whole framework.<\/p>\n\n <h2 class=\"sec\" id=\"ops\">Rate limits and the OPS threshold<\/h2>\n <p>Rate control deserves its own attention, because it changes a client\u2019s obligations, not just the technical limits.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px;text-align:left\">Rate control<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Limits scale with the order rate<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Order-placement APIs are rate-limited, and crossing the orders-per-second threshold shifts a client into registered-algo territory with heavier obligations. Getting this right is central to broker API security.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"How order-per-second thresholds change broker API obligations\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Rate limits change with the order rate<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"60\" y=\"100\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">Below the OPS threshold<\/text>\n <line x1=\"60\" y1=\"112\" x2=\"356\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"60\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Under about 10 orders per<\/text>\n <text x=\"60\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">second: treated as a regular<\/text>\n <text x=\"60\" y=\"178\" fill=\"#4a5170\" font-size=\"12\">API user, no algo registration.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"450\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Above the threshold<\/text>\n <line x1=\"450\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"450\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Higher order rates require algo<\/text>\n <text x=\"450\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">registration, an Algo ID, and<\/text>\n <text x=\"450\" y=\"178\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">extra compliance scrutiny.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Order-placement APIs carry per-second, per-minute, and per-window limits enforced per user. The orders-per-second threshold matters most: a client trading below roughly ten orders per second is treated as a regular API user, while crossing it moves them into registered-algo territory, requiring an Algo ID and additional compliance scrutiny. For a broker, enforcing these limits reliably, and distinguishing normal use from abusive bursts, is a core part of the requirement, and a common point of failure during volatile market periods.<\/p>\n\n <h2 class=\"sec\" id=\"test\">Testing your trading API<\/h2>\n <p>Because these APIs move money and orders at speed, testing them is not optional. Strong broker API security means regular vulnerability assessment and penetration testing focused on the API layer, where broken authentication, weak session handling, missing rate limits, and business-logic flaws tend to hide. An automated scan alone will not find the logic issues that matter in a trading API, our guide on <a href=\"https:\/\/www.osto.one\/resources\/blog\/vapt-vs-vulnerability-scanning\/\">VAPT versus vulnerability scanning<\/a> explains why skilled, human-led testing is what an audit and a real attacker both demand.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Reliability is now part of compliance<\/div>For a trading platform, uptime and security are intertwined. Dropped connections and delayed order updates during volatile periods are not just a user-experience problem, they signal weak API controls. SEBI\u2019s framework treats robust, tested, rate-controlled APIs as a compliance obligation, not just an engineering goal.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to API security for stock brokers<\/h2>\n <p>Meeting all of this, authentication, rate control, traceability, encryption, and ongoing API testing with audit-ready evidence, is a heavy lift for a broking or trading-platform team without a large security function. Assembling it from separate tools and consultants is slow and hard to keep current. The efficient path is one platform that runs the testing and organises the evidence together.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups and lean trading teams. It runs VAPT across your trading APIs and platform, checks for the authentication, session, and business-logic flaws that hit order-placement APIs, supports encryption and monitoring, and keeps organised, audit-ready evidence, mapped across the SEBI CSCRF expectations, DPDP, and 200+ frameworks on one platform. Meeting this bar, without building a large security function, is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Get API security for stock brokers right, and audit-ready.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups and lean trading teams. Test your trading APIs, harden authentication and rate control, and keep audit-ready evidence, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is API security for stock brokers?<\/summary><p>It is the set of controls SEBI and the exchanges require on broker and trading-platform APIs: Algo ID tagging, static IP whitelisting, rate and orders-per-second limits, two-factor authentication, encryption, and an audit trail tying every order to a real user. It became mandatory for all brokers from April 2026.<\/p><\/details>\n <details><summary>What is Algo ID tagging?<\/summary><p>Every algorithmic order must carry a unique, exchange-assigned Algo ID, whether it comes from a broker, a third-party provider, or a self-built strategy. It lets exchanges track order behaviour in real time and ties each order to its origin.<\/p><\/details>\n <details><summary>Do broker APIs need static IP whitelisting?<\/summary><p>Yes. Brokers must block API requests from dynamic or non-whitelisted IPs. Clients provide one or more static IP addresses that the broker whitelists, which is a core part of API security for stock brokers.<\/p><\/details>\n <details><summary>What are the rate limits for trading APIs?<\/summary><p>Order-placement APIs carry per-second, per-minute, and per-window limits enforced per user. The orders-per-second threshold, around ten, is significant: crossing it moves a client into registered-algo territory with an Algo ID and extra scrutiny.<\/p><\/details>\n <details><summary>Is two-factor authentication required for trading APIs?<\/summary><p>Yes. Trading APIs require multi-factor authentication, typically an OAuth flow with a time-based one-time password for session initiation, in line with SEBI\u2019s authentication expectations for automated trading.<\/p><\/details>\n <details><summary>How should a broker test its trading API?<\/summary><p>With regular vulnerability assessment and penetration testing focused on the API layer, covering authentication, session handling, rate limiting, and business-logic flaws. An automated scan alone is not enough, human-led testing is what an audit and a real attacker both require.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>API Security for Stock Brokers: 6 Critical Rules | Osto API security for stock brokers and trading platforms became a\u2026<\/p>\n","protected":false},"author":8,"featured_media":1266,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[655,656],"class_list":["post-1265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-api-security-for-stock-brokers","tag-trading-api-security"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1265"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1265\/revisions"}],"predecessor-version":[{"id":1267,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1265\/revisions\/1267"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1266"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}