Customer Auth Overview

Customer auth is separate from trading account auth. Core customer auth methods are documented separately:

• CustomerRegistration
• AuthCustomer
• CustomerForgotPassword
• CustomerResetPassword
• AuthCustomerByCode
• CustomerChangePassword
• GetCustomerSelf
• UpdateCustomerSelf
• GetCustomerAccountGroups
• OpenCustomerAccount

Additional customer session utility methods are documented separately:

• GetCustomerSessionAccounts
• GetCustomerOTP
• SetCustomerOTP
• CheckCustomerOTP
• ResetCustomerOTP

For staff-issued one-time terminal links to existing customers or trading accounts, see the Normal SSO Codes endpoints. These codes create ordinary customer/account sessions and are separate from the manager impersonation flow in AuthCustomerByCode.

• Customer login uses email + password.
• Successful login creates a SESSION_CUSTOMER token.
• Session-creating responses can also include __datalake_token; its signed claim format and limitations are documented in the Data Lake token profile.
• If OTP is enabled for the customer, otp_code is required during login.
• Trading actions still require choosing an account context from linked accounts.

TOTP Parameters

Parameter	Value
Algorithm	SHA1
Digits	6
Period	30 seconds
Valid window	1