EDX Markets · Authentication Profile

Edx Markets Authentication

Authentication

How clients authenticate to EDX Markets. Connectivity is FIX over a mutually-authenticated TLS (mTLS) tunnel: the member generates a self-signed X.509 client certificate and shares only the .crt with EDX Market Operations (the private key never leaves the member), plus whitelists source IPs. On top of the transport, each FIX session authenticates at the application layer with a FIX Logon (MsgType 35=A) carrying the assigned SenderCompID / FIX ID (username). There is no API-key or OAuth surface.

EDX Markets secures its APIs with mutualTLS and fix-session-logon across 2 declared security schemes, as derived from its OpenAPI definitions.

CompanyCryptoCryptocurrencyDigital AssetsExchangeTradingFIX ProtocolMarket DataClearingInstitutional
Methods: mutualTLS, fix-session-logon Schemes: 2 OAuth flows: API key in:

Security Schemes

mutualTLS mutualTLS
fixLogon fix-session
scheme: FIXT.1.1 session logon (MsgType 35=A)

Source

Authentication Profile

edx-markets-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: >-
  https://edxmarkets.com/vr-edx-markets/ — EDX Self-Signed Certificate Guide
  and EDXM FIX Order Entry Specifications. EDX is a FIX-protocol institutional
  venue; there is no REST/OpenAPI security scheme, so this profile is captured
  from the published connectivity documentation rather than derived from a spec.
docs: https://edxmarkets.com/wp-content/uploads/EDX-Self-Signed-Certificate-Guide.pdf
description: >-
  How clients authenticate to EDX Markets. Connectivity is FIX over a
  mutually-authenticated TLS (mTLS) tunnel: the member generates a self-signed
  X.509 client certificate and shares only the .crt with EDX Market Operations
  (the private key never leaves the member), plus whitelists source IPs. On top
  of the transport, each FIX session authenticates at the application layer with
  a FIX Logon (MsgType 35=A) carrying the assigned SenderCompID / FIX ID
  (username). There is no API-key or OAuth surface.
summary:
  types: [mutualTLS, fix-session-logon]
  transport: FIX 5.0 SP2 over mTLS (self-signed X.509 client certificate)
  key_locations: []
  oauth2_flows: []
schemes:
  - name: mutualTLS
    type: mutualTLS
    detail: >-
      Self-signed X.509 client certificate with extendedKeyUsage=clientAuth,
      generated by the member (openssl req -newkey rsa:4096 -sha256 -x509
      -days 3650). The .crt is shared with EDX Market Operations to load into
      the environment; the private key is retained by the member and used by
      the FIX client or an stunnel tunnel to establish the mTLS endpoint.
    provisioning: >-
      Manual — .crt file plus source IP addresses are submitted to Market
      Operations for whitelisting before connectivity is enabled.
  - name: fixLogon
    type: fix-session
    scheme: FIXT.1.1 session logon (MsgType 35=A)
    detail: >-
      Application-layer session authentication. The Logon (IN) message
      establishes the FIX session under the member's assigned FIX ID
      (Account/username, Tag 1). Session integrity is maintained with
      Heartbeat, TestRequest, ResendRequest and SequenceReset messages.
environments:
  - name: Production
    docs: https://edxmarkets.com/wp-content/uploads/EDXM-FIX-Order-Entry-Specifications.pdf
  - name: UAT
    docs: https://edxmarkets.com/wp-content/uploads/EDXM-FIX-Order-Entry-Specifications-UAT.pdf
contacts:
  connectivity: connectivity@edxmarkets.com
  apis_market_data: apis@edxmarkets.com