Stocks & Shares ISA — API key returns 401 Unauthorized on every request (3 fresh keys tried)

🤝 Help
1

Hi all,

I’m trying to use the Public API against my Stocks & Shares ISA account and every request comes back 401 Unauthorized, regardless of key, auth format, or client used. Hoping someone from the team or who’s hit this before can point me in the right direction, since there’s no support email for this.

Setup:

  • Account: Stocks & Shares ISA
  • Endpoints tried: /api/v0/equity/account/cash, /api/v0/equity/account/info
  • Tested against both live.trading212.com and demo.trading212.com — same result on both

What I’ve tried (all give an identical 401):

  • 3 separate keys generated fresh via Settings → API (Beta), the last with every permission scope enabled
  • Auth header tried as: HTTP Basic (base64(KeyID:Secret)), Basic reversed (base64(Secret:KeyID)), bare Secret Key with no prefix, and Bearer <Secret>
  • Confirmed no whitespace/encoding issues in the copied credentials
  • Ruled out IP allowlisting (it’s off by default and I tested from two different networks)
  • Reproduced with hand-written curl and with the trading212-api npm client used exactly per its README — same 401 either way, so it’s not a client-side bug on my end

Response details every time:

  • 401 Unauthorized
  • Body is just a single newline byte, no error message
  • No WWW-Authenticate header
  • Confirmed hitting the real backend, not a CDN/challenge page (cf-cache-status: DYNAMIC)

CF-RAY IDs from failed requests (happy to share timestamps/key ID via DM if that helps someone trace it server-side):
a2986357e8a5ecea-LHR, a2987fa5ed2d9498-LHR, a2987fa6ffb926c6-LHR, a29887ae7e8493f9-LHR, a29887af6ff050f1-LHR, a29d20686f7a60ea-LHR, a29d284eaf6f0c36-LHR

Question: Is there an additional activation step for API access on ISA accounts beyond generating a key (e.g. does the key only work if generated while the account switcher is specifically on the ISA tab, or is there a beta enrollment gate separate from the Settings toggle)? Any pointers appreciated — thanks!

I signed up to trading212 specifically for this feature.

2

I had a similar problem many months ago. First generate your secret codes again and as part of this process make sure you enable the endpoints you want to use.

For your first attempt, use one of the simplest API calls e.g. Account Info. Don’t forget the base64 conversion.

I submitted my secret codes via http headers. I’ve never used the parameter method. Be sure to use the correct header numbers.

That’s all I can think of at the mo.

3

Thanks - that worked.
I had generated multiple keys during my attempts.
Once i removed them all, and then regenerated a new one, it worked (using the quickstart in the docs)