Test before live
Develop against a paper environment before a key can touch a live account.
Loading Tijarat
Tijarat for developers
Tijarat API.
The planned API will support scoped keys for personal dashboards, alerts, account data, and guarded orders. API access is not live yet.
Coming soon
const response = await fetch(
"/v1/api/quote/HBL",
{ headers: { Authorization: "Bearer tij_test_..." } }
);
// planned scope: read:market200 OK
{ "environment": "test", "symbol": "HBL" }
API permissions
You decide what each key can access.
Every key starts with no permissions. Choose its environment, data access, order access, and limits.
Explicit scopes
Separate market, account, order-history, and trade permissions instead of one all-powerful token.
Same risk boundary
API orders pass the same pre-trade checks and audit trail as orders placed in the app.
Withdrawals stay out
API keys do not become a shortcut around verified funding and withdrawal controls.
FIRST RELEASE
A focused API for the things investors actually build.
The first API covers quotes, charts, positions, order history, and guarded orders. Full documentation ships with sandbox access.
GET
/v1/api/accountRead account identity and environmentGET
/v1/api/quote/HBLRead a market quoteGET
/v1/api/board/HBLRead the supported market boardGET
/v1/api/candles/HBLRead chart candlesGET
/v1/api/positionsRead your positionsGET
/v1/api/ordersRead order historyGET
/v1/api/transactionsRead account transactionsPOST
/v1/api/ordersSubmit a guarded orderPOST
/v1/api/orders/{id}/cancelRequest order cancellationFirst public contract
Environment, scopes, receipts, and limits are part of the API.
The base URL and complete reference will be published only when the sandbox is open.
Test stays isolated
Keys beginning with the test prefix use a server-side paper account. A test key cannot read or trade a live account.
Four explicit permissions
read:market, read:account, read:orders, and trade. A key begins with no scope and withdrawals never enter the API boundary.
One command, one receipt
Order writes use an idempotency key and return a command receipt so a network retry does not silently duplicate an instruction.
Published request limits
The planned first release allows up to 300 requests per minute per IP and 60 per minute per API key, with explicit limit errors.
AFTER THE FIRST RELEASE
Streaming, webhooks, IP allowlists, HMAC, and SDKs.
These are planned, not quietly implied. They remain Coming soon until the protocol, authentication, delivery guarantees, and examples are documented.
Coming soon
Get the sandbox invitation.
We will send documentation, limits, and test access when the public sandbox opens.
Tijarat
Build on the same rules as the app.
API keys use the same market-data, account, and order controls as Tijarat.