How to Connect a ProjectX Prop-Firm Login Safely

Do not begin by entering a prop-firm website password into a generic connector. Confirm that the destination is genuinely ProjectX-backed and find the firm's current API instructions. Branded platforms can use ProjectX infrastructure while presenting their own account portal, billing, profile link, and policy. The official firm help center—not another trader's setup video—determines which credential process applies.

TopstepX is a concrete example, not a universal template. Its current instructions require a ProjectX Dashboard account, a separate API Access subscription, linking that subscription to the TopstepX profile, and generating an API key inside TopstepX. Another ProjectX-backed provider may differ. A connector should ask for the documented API credential, not silently reuse an interactive password.

A billing portal login may manage subscriptions, while a trading-platform identity selects accounts, and an API key authorizes programmatic requests. These identities can share an email without being interchangeable. If documentation says to create and link a key, a username/password form in an unofficial tool is not an equivalent shortcut. If a key-generation option is absent, stop and confirm eligibility rather than harvesting browser tokens.

Topstep warns that its generated API key provides trading access to every eligible account under the profile. Store the key like a broker password in an operating-system secret store on the permitted personal device. Display only a short fingerprint. Never put it in TradingView JSON, query parameters, source code, a cloud log, or a screenshot. Rotate it immediately if exposure is suspected.

As reviewed on August 30, 2026, Topstep's flow has four parts. The trader creates or uses a ProjectX Dashboard account, purchases ProjectX API Access, opens TopstepX settings to link the subscription to the TopstepX profile, and then generates an API key from the API tab. Topstep notes that skipping the linking step can produce User lacks subscription.

Do not freeze pricing or eligibility assumptions into connector copy; confirm the current article during setup. More importantly, read the location rules on that same page. It says trading activity must originate from the personal device and that VPS, VPN, or remote-server order activity is prohibited. Supporting work can be allowed on a private server only when it does not touch order flow, such as listed research, logging, storage, analytics, or read-only display.

Do not let the webhook supply accountId and do not select the first returned account. A profile can expose several Practice, evaluation, or funded accounts over time. Display account names, IDs, status, and any stage metadata the supported interface provides. Bind the selected ID to one deployment and maintain an allowlist. If the account disappears or becomes ineligible, disarm the deployment.

ProjectX's order endpoint requires accountId and contractId. Those values should come from authenticated discovery, not from an email, a dashboard nickname, or a copied chart ticker. Refresh discovery after account creation, reset, promotion, closure, or profile relinking. Treat a changed account ID as a new production destination requiring risk and policy approval.

A strategy may emit MES or a continuous TradingView symbol, but ProjectX order placement expects its contractId. Search or retrieve the current contract through supported resources, verify that it is entitled and appropriate for the account, and store the mapping with an expiry review. Reject a missing or ambiguous match. A root-to-contract map should never roll while an old-contract position remains unnoticed.

The connection also needs independent order quantity, product, session, net position, working-order, and daily loss controls. The provider's account rules remain a separate outer boundary. ProjectX's technical rate limits are not strategy-frequency permission, and a successful order response is not proof that a firm permits that method. Keep policy evidence attached to the deployment.

Account stages can change the account ID, risk limits, eligible products, and permitted API path. Do not carry a green enabled flag forward because the strategy traded successfully yesterday. Detect the change through supported account data where possible, and require the operator to confirm the new stage from the firm's official portal and current rules.

Topstep's current Live Funded page is explicit: automated strategies may be allowed in general, but automated trading through the ProjectX API is prohibited in the LFA. That makes a successful Express Funded connection unsafe to reuse after a Live call-up. Technical connection is not permission; private server order relay and Live Funded API limits must be verified in current official rules before rearming.

A good first test retrieves accounts, selects the intended ID, resolves one current micro contract, and reads orders and positions without trading. Confirm that no private server, VPS, VPN, or relay participates where the current provider rules prohibit it. Then use a Practice environment if the provider directs that path; Topstep currently says there is no separate API sandbox and points testing to a Practice account.

For the first permitted order, record event ID, account ID, contract ID, side, size, API acknowledgement, order ID, execution updates, and final position. Test a duplicate event and an expired session. Stop if the account stage cannot be proven, if the contract is ambiguous, or if the tool cannot recover state after reconnect. Connectivity is complete only when the account can be reconciled.