Saxo OpenAPI C# Authentication & Streaming

C# implementation for Saxo Bank OpenAPI authentication and real-time streaming with automatic token management.

Quick Start

Requirements

• .NET 9.0 or later
• appsettings.json configured with own app credentials

Available Scripts

• WebSocket Streaming → streaming/WebSocketSample.cs
• Authorization Code Flow → auth/AuthenticationCodeFlow/AuthSample.cs
• Authorization Code with PKCE → auth/AuthenticationPKCE/PkceAuthSample.cs

Setup

1. Copy configuration file: cp appsettings.example.json appsettings.json
2. Configure appsettings.json with credentials from developer portal:

{
  "AppName": "your_app_name_here",
  "AppKey": "your_app_key_here",
  "AppSecret": "your_app_secret_here",
  "AuthorizationEndpoint": "https://sim.logonvalidation.net/authorize",
  "TokenEndpoint": "https://sim.logonvalidation.net/token",
  "GrantType": "Code",
  "OpenApiBaseUrl": "https://gateway.saxobank.com/sim/openapi",
  "RedirectUrls": ["http://localhost:3000/callback"]
}

Note:

• GrantType can be "Code", "PKCE", or any other value for manual token entry (case-insensitive)
• AppSecret is only required for Authorization Code flow (not needed for PKCE)
• RedirectUrls is an array; the scripts use the first entry
• Streaming URLs are automatically determined from OpenApiBaseUrl (sim vs live environment)

WebSocket Streaming

Automatically handles OAuth authentication and streams real-time price updates:

cd streaming
dotnet run

Authentication Options:

1. OAuth Code Flow - Set GrantType: "Code" in appsettings.json
2. OAuth PKCE Flow - Set GrantType: "PKCE" in appsettings.json
3. Manual Token Entry - Set GrantType to any other value (or omit it)

The streaming sample subscribes to account balance updates and demonstrates:

• Binary WebSocket message parsing
• Control message handling (_heartbeat, _resetsubscriptions, _disconnect)
• Automatic token refresh before expiry
• WebSocket reauthorization with new tokens
• Connection recovery on errors

Port Handling:

• Reads port from first url in RedirectUrls property in appsettings.json (defaults to 3000 if not specified)
• If port is busy, displays error message and stops (user must free the port or update config)

How It Works

1. Authentication: Automatically selects OAuth flow based on GrantType setting
   • "Code" → Uses Authorization Code Flow with client secret
   • "PKCE" → Uses PKCE flow (no client secret needed)
   • Other → Prompts for manual token entry (disables refresh)
2. Token Management: Automatically refreshes tokens at 85% of lifetime
3. WebSocket Reauth: Reauthorizes active WebSocket connections on token refresh
4. Control Message and Error Handling: Reconnects (if possible) on WebSocket errors or control messages.

Authentication Samples

The OAuth 2.0 flow samples can be run independently to test authentication:

Authorization Code Flow:

cd auth/AuthenticationCodeFlow
dotnet run

Authorization Code with PKCE:

cd auth/AuthenticationPKCE
dotnet run

Both samples:

• Start a local HTTP listener for OAuth callbacks
• Display authorization URL for browser login
• Exchange authorization code for access and refresh tokens
• Automatically refresh the token at 85% of its lifetime in a loop

App Registration

Register apps at: https://www.developer.saxo/openapi/appmanagement

The app variables are what should populate appsettings.json.