Skip to content
API status
Start here

QR account connections

Generate broker, account, and one-time auto-login QR codes for Koneth Terminal.

The Management API can generate QR codes that help a trader connect to a Koneth Terminal account. A QR code can identify a broker, prefill an account number, or complete a one-time automatic sign-in.

Use a Management API key with the accounts:connect scope. The key must also have access to the target server.

Choose a QR mode

Section titled “Choose a QR mode”
Mode QR contents Terminal behaviour
broker Broker identifier and server name. Opens the broker and leaves the account fields empty.
account Broker identifier, server name, and account number. Opens the broker with the account number prefilled. The trader still enters a password.
auto_login Broker details, account number, access type, and a one-time connection code. Connects the account automatically.

Auto-login codes never contain a password. Koneth Main stores a hash of the connection code and uses the matching stored trading or investor credential only while redeeming it.

Create the QR code

Section titled “Create the QR code”
POST /api/v1/management/servers/{serverId}/connection-qr
Authorization: Management kapi.<key-id>.<secret>
Content-Type: application/json

Request fields:

Field Required Description
mode Yes broker, account, or auto_login.
accountNumber For account and auto_login Account to prefill or connect.
credentialType No trading or investor. Defaults to trading.
expiresInSeconds No Auto-login lifetime from 60 to 3600. Defaults to 600.

Broker only

Section titled “Broker only”
Terminal window
curl --request POST \
  --url "https://api.koneth.com/api/v1/management/servers/$SERVER_ID/connection-qr" \
  --header "Authorization: Management $KONETH_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "mode": "broker"
  }'

Broker and account number

Section titled “Broker and account number”
Terminal window
curl --request POST \
  --url "https://api.koneth.com/api/v1/management/servers/$SERVER_ID/connection-qr" \
  --header "Authorization: Management $KONETH_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "mode": "account",
    "accountNumber": "46370895"
  }'

One-time investor auto-login

Section titled “One-time investor auto-login”
Terminal window
curl --request POST \
  --url "https://api.koneth.com/api/v1/management/servers/$SERVER_ID/connection-qr" \
  --header "Authorization: Management $KONETH_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "mode": "auto_login",
    "accountNumber": "46370895",
    "credentialType": "investor",
    "expiresInSeconds": 600
  }'

The response contains the connection payload and an SVG QR image:

{
  "connection": {
    "id": "8b305e64-17f4-43fb-8b26-b38592e78423",
    "mode": "auto_login",
    "credentialType": "investor",
    "serverId": "ef07e88a-2445-4c7c-90d6-f4569b7ff33b",
    "serverName": "Example-Demo",
    "accountNumber": "46370895",
    "payload": "koneth-trader://connect?v=1...",
    "expiresAt": "2026-10-23T07:20:00.000Z"
  },
  "qr": {
    "mimeType": "image/svg+xml",
    "dataBase64": "PHN2ZyB4bWxucz0i..."
  }
}

For a static broker or account code, expiresAt is null.

Display the QR code

Section titled “Display the QR code”

Create a data URL from the base64 image:

<img
  alt="Connect to Example-Demo in Koneth Terminal"
  src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0i..."
/>

You can display the data URL in the broker’s own portal, onboarding flow, email, or support tooling. Do not publish an auto-login QR code in a reusable public page; it is a single-use credential until it expires.

Revoke an auto-login code

Section titled “Revoke an auto-login code”
POST /api/v1/management/servers/{serverId}/connection-qr/{connectionId}/revoke
Authorization: Management kapi.<key-id>.<secret>

Revocation prevents the code from being redeemed. Any Management API key for the same organization can revoke it if the key has server access and accounts:connect.

What the Terminal does

Section titled “What the Terminal does”
  1. Validates the payload

    The Terminal accepts only versioned koneth-trader://connect payloads.

  2. Resolves the broker

    The broker is loaded through Koneth server discovery. A server URL from inside the QR is never trusted or used.

  3. Prefills or connects

    Broker and account modes open the normal login screen. Auto-login redeems the one-time code before creating the trading session.

The Terminal-facing redemption endpoint is not part of the Management API and must not be called by broker backends. It is documented here only so support teams understand the connection flow.