# Changelog #1 — Sign in from Claude, copy trading, and more > Week of 12 October 2026: sign in to fxapis from Claude and ChatGPT, managed copy trading, webhooks that catch up after downtime, and security, data and SDK updates. Published 2026-10-16 by fxapis. Canonical: https://fxapis.com/blog/changelog-1-sign-in-from-claude-copy-trading ## In short - The MCP server takes sign-in from claude.ai, Claude Desktop, Claude Code and ChatGPT: read-only, or trading on the accounts you pick (needs two-factor), revocable under Connected apps on the API keys page. - Managed copy trading has an API, a console page, SDK support and pricing. Copying starts after the upcoming scheduled maintenance; until then new strategies and subscriptions answer 503 COPY_TRADING_PAUSED. - GET /v1/events lets a client catch up after downtime, replay re-sends only what an endpoint missed, and events are kept 7, 30 or 90 days by plan. - Breaking: ordinary API keys can no longer call /v1/api-keys; use an admin key. MCP lists now answer { items, next_cursor, total }. - TypeScript SDK 0.3.0 and Python SDK 0.2.0 add the copy trading client. Welcome to the first fxapis changelog post. Each week we'll write up what shipped, with the bigger changes explained and the rest in a short list. This one covers Monday 12 to Friday 16 October 2026. The [docs changelog](https://docs.fxapis.com/changelog) stays the complete record, endpoint by endpoint. This week, AI assistants can sign in to fxapis instead of holding an API key, copy trading became part of the API, and webhooks can catch up after downtime. ## Sign in to fxapis from Claude and ChatGPT The MCP server at `https://api.fxapis.com/mcp` now accepts sign-in (OAuth 2.1 with PKCE) as well as API keys. Add it to claude.ai, Claude Desktop, Claude Code or ChatGPT developer mode, sign in, and choose on the consent screen: **read-only**, or **trading on the accounts you pick**. Trading needs two-factor turned on. Your session already proved it when you signed in, so the consent screen doesn't ask for a code. A connected app can read every account. Anything it changes (opening, closing, stops, cancelling, bringing an account online or taking it offline) is limited to the accounts you picked, and a write on any other account answers `403 KEY_LIMIT_EXCEEDED`. Every connected app is listed under **Connected apps** on the [API keys page](https://fxapis.com/dashboard/keys), and you can revoke it there at once. Alongside sign-in: - **Smaller tool results.** The data comes once, as compact JSON next to a one-line summary. Read tools take `response_format` (`concise` by default, or `detailed`), and the long lists page with `limit` and `cursor`. **Every list now answers `{ items, next_cursor, total }`** instead of `accounts`, `positions`, `orders` and so on, so update any agent code that reads the old keys. - **Two tools that answer a whole question in one call:** `get_account_overview` and `get_symbol_snapshot`. - **A read-only connector** at `https://api.fxapis.com/mcp/insights`, for the Claude and ChatGPT directories. - **A Claude Code plugin and skill.** `/plugin marketplace add FXapis/fxapis-claude-plugins` installs the MCP server with sign-in, the `trading-mt5-safely` skill, the `/fxapis:status` and `/fxapis:positions` commands, and a hook that asks you before every fxapis trade. The hook also refuses trades on live accounts until you allow them. The plugin is open source at [FXapis/fxapis-claude-plugins](https://github.com/FXapis/fxapis-claude-plugins). To set it up, read [MCP server](https://docs.fxapis.com/guides/mcp), [Read-only connector](https://docs.fxapis.com/guides/mcp-read-only) and [Claude plugin and skill](https://docs.fxapis.com/guides/claude-plugin). ## Managed copy trading Copy trading is now part of the API, so you don't have to write and run the copier yourself. Mark an always-on account as a strategy and subscribe followers in the same workspace. fxapis then copies opens, closes, partial closes and stop moves on its servers, about every second. A subscription has five sizing modes, reversal, symbol filters and mapping, and limits on lateness and price. Its risk limits stop the subscription and can close its positions. A drift check runs alongside, and every copy is logged with its reason. It works with hedging accounts only. - **API:** `/v1/copy/strategies`, `/v1/copy/subscriptions` and `/v1/copy/executions`. Multi-account orders made by copy trading appear in `GET /v1/execution-waves`, labelled `Copy: `. - **Console:** a new **Copy trading** page. - **SDKs:** the copy trading client is in TypeScript SDK 0.3.0 and Python SDK 0.2.0. - **Webhooks:** `copy.executed`, `copy.skipped`, `copy.failed`, `copy.subscription_stopped`, `copy.drift_corrected` and `copy.master_disconnected`. - **Plans:** Trial includes 3 followers. Production is $8 per follower per month. Business includes 25, then $6 each. Enterprise is by agreement. Followers are billed by the day. **Copying hasn't started yet.** It starts after the upcoming scheduled maintenance. Until then, creating a strategy, subscribing, resuming and resetting answer `503 COPY_TRADING_PAUSED`. Reading, changing settings, pausing and deleting all work, but nothing is copied and no follower is billed. `GET /v1/copy/status` tells you whether copy trading is paused. The [Copy trading guide](https://docs.fxapis.com/guides/copy-trading) explains each setting. ## Webhooks that catch up after downtime - **The event list.** `GET /v1/events?after=` returns every event after the last one you read, oldest first, exactly as webhooks deliver them. A client that was down can catch up on its own. You can filter by `type`, `account_id`, time or `delivery_status=failed`. Reading the list needs `history:read`. - **Retention by plan.** Events are kept 7 days on Production, 30 days on Business and 90 days on Enterprise. - **Replay.** `POST /v1/webhooks/{id}/replay`, or **Replay events** in the console, sends only the events an endpoint didn't receive, either because delivery gave up or because they were recorded while the endpoint was off. `include: "all"` re-sends everything in the window. A paused or switched-off endpoint now keeps its waiting deliveries and sends them when you turn it back on. - **Full delivery logs**, kept 30 days on every plan: each attempt's request as sent and your endpoint's answer. - **Better retries.** Retries are spread out and honour `Retry-After`, and a `410 Gone` switches an endpoint off at once. A slow endpoint no longer delays anyone else's deliveries. See [Catch up after downtime](https://docs.fxapis.com/guides/webhooks#catch-up-after-downtime). ## Fixes and improvements ### Console and security - **Account alerts.** A bell on every console page counts the accounts that need your attention: a refused login, two-factor, a certificate, trading disabled, or an error lasting over two minutes. **Notifications** lists them with the fix, and each alert closes by itself when the account recovers. - **Confirm it's you before sensitive changes.** Changing who can do what (keys, invitations, roles, removing people) and changing your plan or payment details asks for your authenticator code, or your password if you don't use two-factor. One confirmation now lasts two hours for members. Creating an API key asks only when the key can move money or accounts (`trading:execute`, `trading:reduce` or `accounts:write`). Narrowing a key's scopes or renaming it never asks. - **Sessions and password under Security.** You can see and end your sessions, and change your password. Changing your password always signs out every other session. - **Console sessions last seven days** and end after a day unused. - **Two-factor belongs to the session.** Turning it on or off, or making new backup codes, signs out every other session. A backup code works wherever a code is asked for. - **Repeated wrong passwords** trigger a quick human check, then a 15-minute pause on the account. - **Removing, suspending or demoting someone revokes the API keys they made**, and the owner is emailed the list. API keys now show who made them (`createdBy`). - The session cookie is moving to `__Host-fxapis.session_token`. It is rolling out over the coming days, and nobody is signed out by the change. ### Trading and account data - **Balance, equity and margin** are on every account response, along with `freeMargin`, `marginLevel`, `credit` and `profit`. They refresh every 15 seconds while the account is online. `GET /v1/accounts/{id}/figures?fresh=true` asks the terminal for them right away. - **Live prices.** `GET /v1/accounts/{id}/quotes` returns up to 20 symbols or instruments from the account's own broker. - **Stop checks use live prices** when the account has a recent quote. - **The position an order opened.** An opening order now carries `brokerPositionId`, the ticket to close it by, taken from the fill itself. - **Pending orders that trigger now leave `working`**, move to `filled` or `partially_filled`, and send one `order.filled` webhook. - **API key limits:** set a maximum lot size per order, the symbols or instruments a key may open, the accounts it may open on, and a number of opening orders per UTC day. Closing is never limited. See [Limits](https://docs.fxapis.com/authentication#limits). - **Multi-account orders take an `instrument`**, such as `XAUUSD`. Each account then trades its own broker's symbol for it. See [Multi-account orders](https://docs.fxapis.com/guides/multi-account-orders). - **MCP:** two more tools, `get_account_figures` and `get_quotes`. ### API keys and workspaces - **Admin keys.** The workspace owner can make an admin key (`fx_admin_…`) in the console. It manages the workspace's API keys and nothing else, so you can automate issuing and rotating keys. An IP allowlist and an expiry are optional, and up to five can be active at once. - **Breaking: ordinary keys can no longer call `/v1/api-keys`.** They now get `403 ADMIN_KEY_REQUIRED`, even keys holding `admin`. Use an admin key or the console instead. - **Member and invitation endpoints are now console-only.** They have been removed from the SDKs and the Postman collection. ## Updated SDKs and repos - **TypeScript SDK 0.3.0** (`fxapis` on npm) adds the copy trading client. Earlier in the week, 0.2.0 moved key management to `fx.admin.keys` and dropped the workspace management methods. It also added `getAccountsByIdFigures` and `getAccountsByIdQuotes`. Source: [FXapis/fxapis-typescript](https://github.com/FXapis/fxapis-typescript). - **Python SDK 0.2.0** (`fxapis` on PyPI) adds the copy trading client. Earlier in the week it gained `client.admin.keys`, `client.accounts.figures(…)`, `client.quotes.get(…)`, `events.list/iter/get` and `webhooks.deliveries/delivery/replay`. Source: [FXapis/fxapis-python](https://github.com/FXapis/fxapis-python). - **[fxapis-claude-plugins](https://github.com/FXapis/fxapis-claude-plugins)** is new this week: the Claude Code plugin and the `trading-mt5-safely` skill. - **[fxapis-mcp-examples](https://github.com/FXapis/fxapis-mcp-examples)** covers signing in from Claude, Claude Code and ChatGPT, and the new tools. - **[fxapis-integrations](https://github.com/FXapis/fxapis-integrations)**: the Postman collection gains copy trading, figures and live prices, admin keys, the event list and replay, instruments and key limits. - **[fxapis-examples](https://github.com/FXapis/fxapis-examples)** and **[fxapis-nextjs-starter](https://github.com/FXapis/fxapis-nextjs-starter)** now use the new SDK releases. The examples close the position an order names, using `brokerPositionId`. That's the week. If something here doesn't behave as described, write to [support@fxapis.com](mailto:support@fxapis.com).