Stockbit Research
research
Playground
@hansputera
Complete reference for authentication flows across the Stockbit API ecosystem.
The main token is a JWT valid for ~90 days, used to authenticate against most Exodus endpoints and as a gateway to obtain other tokens.
Authorization: Bearer <main_token>
| Method | Path | Description |
|---|---|---|
| POST | /login/v3/username/browser |
Browser username login |
| POST | /login/v4/facebook |
Facebook login |
| POST | /login/v4/google |
Google login |
| POST | /login/refresh |
Refresh main JWT |
POST /login/refresh
Authorization: Bearer <main_token>
Short-lived token bridging main auth and the trading system. Required (with trading PIN) to obtain the trading JWT.
GET https://exodus.stockbit.com/sekuritas/auth/token
Authorization: Bearer <main_token>
{ "data": { "token": "sekuritas_token_string" } }
import requests
sekuritas_token = requests.get(
"https://exodus.stockbit.com/sekuritas/auth/token",
headers={"Authorization": f"Bearer {main_token}"}
).json()["data"]["token"]
Separate JWT for Carina (carina.stockbit.com). Obtained by exchanging sekuritas token + 6-digit PIN. Valid ~24h, refreshable.
POST https://carina.stockbit.com/auth/v2/login
Content-Type: application/json
{ "login_token": "sekuritas_token", "pin": "YOUR_TRADING_PIN" }
{
"data": {
"access_token": "trading_jwt",
"refresh_token": "refresh_jwt",
"account": { "number": "2778867", "type": "ACCOUNT_TYPE_EQUITY" }
}
}
POST https://carina.stockbit.com/auth/refresh
Authorization: Bearer <trading_token>
main_token (JWT, ~90d)
→ GET /sekuritas/auth/token → sekuritas_token
→ POST /auth/v2/login { login_token, pin } → trading_token (~24h)
→ POST /auth/refresh → new trading_token (~24h)
Required to authenticate trading WebSocket connections.
GET https://exodus.stockbit.com/auth/websocket/key
Authorization: Bearer <main_token>
{ "data": { "key": "websocket_key_string" } }
Two sequential protobuf messages on connect to wss://wss-trading.stockbit.com/ws:
user_id + key + access_token (no channel)user_id + key + access_token + channel with stocksfrom stockbit_api.proto.stockbit_pb2 import WebsocketRequest
auth = WebsocketRequest()
auth.user_id = "3468390"; auth.key = wskey; auth.access_token = "<main_token>"
sub = WebsocketRequest()
sub.user_id = "3468390"; sub.key = wskey; sub.access_token = "<main_token>"
sub.channel.liveprice.extend(["BBRI", "BBCA"])
await ws.send(auth.SerializeToString())
await ws.send(sub.SerializeToString())
Chart WS (?type=chart) additionally sends periodic ping every ~30s:
ping = WebsocketRequest()
ping.ping.message = "ping"
6-digit numeric PIN securing trading operations.
| Method | Path | Description |
|---|---|---|
| POST | /user/setting/pin |
Set trading PIN |
| POST | /auth/pin |
Authenticate PIN |
| POST | /auth/pin/reset |
Reset PIN |
| Method | Path | Description |
|---|---|---|
| POST | /auth/pin/validate |
Validate PIN |
| POST | /auth/pin/change |
Change PIN |
| POST | /auth/v2/pin/change/new |
New PIN (v2) |
| POST | /auth/v2/pin/change/confirm |
Confirm PIN change |
| POST | /auth/v2/pin/change/otp/send |
Send OTP |
| POST | /auth/v2/pin/change/otp/verify |
Verify OTP |
| POST | /auth/v2/pin/reset/validate |
Start reset |
| POST | /auth/v2/pin/reset/new |
Set new PIN |
| POST | /auth/v2/pin/reset/confirm |
Confirm reset |
| POST | /auth/v2/pin/reset/otp/send |
Send OTP |
| POST | /auth/v2/pin/reset/otp/verify |
Verify OTP |
| Status | Error Type | Meaning |
|---|---|---|
| 401 | INVALID_AUTH |
Token expired or invalid |
| 401 | INVALID_TOKEN |
Token expired or invalid |
| 400 | INVALID_PARAMETER |
Missing/invalid fields |
| 500 | — | Server error |
StockbitError
├── AuthenticationError
│ ├── InvalidPINError
│ └── TokenExpiredError
├── InsufficientBalanceError
├── OrderRejectedError
├── RateLimitError
└── WebSocketDisconnectError
| Service | Base URL | Auth |
|---|---|---|
| Exodus (Main) | https://exodus.stockbit.com |
Bearer <main_token> |
| Carina (Trading) | https://carina.stockbit.com |
Bearer <trading_token> |
| Trading WS | wss://wss-trading.stockbit.com/ws |
Protobuf (user_id + key + token) |
| General WS | wss://ws-gen.stockbit.com/v1 |
Securities token |
| Social WS | wss://wssocial.stockbit.com |
(see social WS docs) |