A secure trading automation system built with Rust (backend) and React + TypeScript (frontend).

The backend is the only component allowed to communicate with the eToro API.
The API key is stored exclusively on the backend and must never be exposed to the frontend.

Angular + TypeScript (UI)
        ↓ HTTP
Rust Backend (Axum API)
        ↓ HTTP
eToro API (Demo or Real)

• Rust (stable)
• Axum (HTTP server)
• Reqwest (HTTP client)
• Tokio (async runtime)
• dotenvy (environment management)

• Angular
• TypeScript
• Vite

• Linux
• Rust (stable toolchain)
• Node.js + npm

Verify installation:

rustc --version
cargo --version
node --version
npm --version
ng version

• NEVER expose the eToro API key in the frontend.
• ALWAYS start development with a Demo key.
• Use IP whitelist when generating keys.
• Set an expiration date on API keys.
• Rotate keys regularly.
• Do not commit .env files to version control.

git clone <your-repository-url>
cd <your-project-folder>

cd backend

Create a .env file:

RUST_LOG=info

ETORO_BASE_URL=https://api-demo.etoro.com
ETORO_API_KEY=your_demo_key_here

BIND_ADDR=127.0.0.1:8080
CORS_ORIGIN=http://localhost:5173

Run the backend:

cargo run

Health check:

http://127.0.0.1:8080/health

Expected response:

{ "ok": true }

cd frontend
npm install
ng serve

Frontend runs at:

http://localhost:5173

/backend
    Cargo.toml
    src/
        main.rs
        config.rs
        routes.rs
        etoro.rs
        models.rs

/frontend
    package.json
    angular.json
    src/
        app/

1. Frontend sends:

POST /api/orders

2. Backend:
   • Validates request
   • Adds Authorization header
   • Sends request to eToro
   • Returns structured response

1. Use Demo API key.
2. Validate:
   • Order placement
   • Position retrieval
   • Error handling
3. Deploy backend to VPS (fixed IP recommended).
4. Generate a Real API key.
5. Update .env with real credentials.
6. Tighten CORS and IP whitelist rules.

• Deploy backend on VPS with static IP.
• Use HTTPS (Let's Encrypt).
• Enable logging and monitoring.
• Limit CORS to your frontend domain.
• Use short-lived API keys (30 days max).
• Implement risk management logic before real trading.

This software interacts with financial markets.
Improper configuration may result in financial loss.
Always test thoroughly in Demo mode before using real funds.

Build a secure, production-ready trading automation engine with:

• Strong backend isolation
• Safe API key management
• Clean architecture
• Scalable structure
• Full control over trading logic