Your terminal key is the one credential that lets a client act on your MetaTrader terminal — within your subscription's capabilities — for as long as it's valid. Treating it with the same care as a password (or an API key) keeps your account yours. Here's how.
Understand what each credential can do
- Terminal key (
MTMCP-…) — durable. It doesn't expire on its own; anyone holding it can act on the bound terminal until you revoke it. This is the one to protect. - Session token (JWT) — short-lived and auto-refreshed. It's minted from the terminal key, so it's not a separate thing to guard so much as a reason the key matters: whoever has the key can mint tokens. See Session tokens: getting and rotating your JWT.
Note that a session token doesn't limit the blast radius of a leaked key — if the key is exposed, revoke the key.
Store it well
- Keep it in your client's config or a secrets manager — not in a chat message, a screenshot, a shared doc, or a public repo.
- Remember the plaintext is shown once at creation. Save it somewhere durable immediately; if you lose it, you generate a new one rather than recovering the old.
- Don't commit config files containing the key to version control. If you must, use environment variables or a secrets store and keep them out of the repo.
Keep it out of the wrong places
- Scrub keys from logs and error reports before sharing them for support.
- Be cautious pasting client configs into forums or issues — redact the
MTMCP-…value. - On a shared machine, don't leave the key in a world-readable file.
The capability floor already limits damage
Even a leaked key can only do what your tier allows on the bound terminal — a free-tier key is read-only, and no key can override your broker's rules or bypass the dry_run and equity-guard protections. That's a floor, not a substitute for keeping the key private.
If a key leaks — act in this order
- Revoke the exposed key from Dashboard → Terminal Keys immediately. New sessions stop within seconds.
- Generate a replacement and deploy it.
- Remember a session already running may keep working until its cached token expires (within about an hour), then fails to refresh.
Full procedure in Rotating or revoking a terminal key.
Next steps
Round out the security picture with Understanding the dry_run safety model and What MTContext can and can't do.