Topstep API Access and Automation Policy

Reviewed August 30, 2026: Topstep's API-access article says users can build automated strategies, connect tools, retrieve market data, and execute through TopstepX using ProjectX technology. It requires a ProjectX API Access subscription, profile linking, and a generated key. It also says custom bots are allowed subject to standard platform rules and a prohibition on high-frequency trading.

That permission is not unlimited. The same article says all trading activity must originate from the user's personal device and prohibits VPS, VPN, and remote-server order flow. The Live Funded Account page adds a stage-specific restriction: automated strategies can be permitted generally, but automated trading via the ProjectX API is prohibited in the LFA. Technical connection is not permission; verify current private server order-relay and Live Funded API limits before deployment.

Topstep's current guide starts with creating or opening a ProjectX Dashboard account and purchasing ProjectX API Access. The trader then opens the API settings in TopstepX and uses ProjectX Linking to associate the subscription with the TopstepX profile. Only after the account appears in ProjectX Dashboard does the guide direct the trader to generate an API key in TopstepX.

The order matters. Topstep's troubleshooting says User lacks subscription commonly means the subscription is not linked. The generated key grants trading access to every eligible account under the profile, so it must be treated as a broker credential. Do not paste it into Pine Script, webhook JSON, a public repository, a remote log, or an unverified third-party service. Rotate it if compromised.

ProjectX documents account, contract, order, position, history, and real-time interfaces. Its place-order route currently accepts accountId, contractId, integer type and side, size, applicable prices, an optional unique customTag, and optional stop-loss or take-profit bracket objects. Integrations should retrieve identifiers through authorized resources and use the current enum reference rather than constructing IDs or values from chart labels.

The ProjectX rate-limit page currently lists 50 history-bar requests per 30 seconds and 200 requests per 60 seconds for other endpoints, with HTTP 429 when limits are exceeded. Those limits describe service fairness, not permission to pursue a particular trading frequency. Clients should cache discovery data appropriately, back off on 429, maintain real-time state, and avoid polling loops that crowd out risk operations.

Topstep lists historical data storage, research, backtesting, logging, analytics, a read-only dashboard, and receiving copies of the trader's own fills, positions, and P&L as server-side supporting work. Those examples have a common property: they do not cause or change an order. Keep them read-only and verify that no callback, queue, or alert can reach an order endpoint.

The prohibited side includes obvious API requests and indirect relays. A cloud webhook receiver that forwards buy to a laptop is still routing or relaying an order trigger. A server that computes the final trade and tells a local agent to submit it also touches order flow. Under the reviewed language, move the signal receiver and decision path that can reach order endpoints onto the permitted personal device, or keep automation disabled pending official clarification.

The LFA restriction is easy to miss because the general API page discusses automation positively. Both statements can coexist: API automation may be available for eligible TopstepX accounts, while one account stage excludes that route. The LFA page says automated strategies are permitted but Topstep cannot support their setup, then explicitly prohibits automated trading via the ProjectX API in the LFA.

A system must therefore detect or require confirmation of account stage. When an Express Funded trader is called to Live Funded, automatically disarm ProjectX order submission. Do not rely on the key failing or the account disappearing. A technically accepted order would not erase a rule violation. Reopen the official LFA page and obtain current guidance for any other permitted automation method before rearming.

The local execution process should own the API key, account allowlist, contract discovery, signal validation, risk limits, and order-state reconciliation. If it receives a signal, the source and transport must also comply with the current no-relay language. A separate server can receive copies of outcomes for permitted logging or read-only dashboards, but it should have no credential or command channel capable of trading.

Store a dated policy record with the deployment: account stage, official URLs, review date, permitted device, process inventory, and reviewer. Make it expire. If the personal device, network method, account ID, stage, strategy behavior, or Topstep language changes, disarm. Security controls should prevent the read-only analytics service from becoming an accidental reverse command path.

Begin with policy, not connectivity. Open the current TopstepX API Access and Live Funded Account Parameters pages. Confirm the account stage in the official product, then verify the actual device and every network hop used by the order path. Authenticate locally, discover eligible accounts, select one ID, resolve one current contract, and compare configured risk limits with the current program rules.

Use a Practice account for testing where Topstep currently directs that approach; its API article says no separate sandbox is available. Test duplicate prevention, expired authorization, rate limiting, rejects, disconnects, and restart recovery. A minimum-size fill is only one checkpoint. The system is ready when it can prove policy eligibility and reconstruct working orders, executions, and positions before accepting another signal.