Deriv · 2026

Free Deriv Bot — How to Build a Trading Bot With No Code

Deriv is the cleanest case for automation: it has an official API (WebSocket/Python) and free demo accounts. You can build a bot with no coding — and ours is open source, with 13 strategies and a browser dashboard.

🤖 Get the free bot (Deriv + Quotex + IQ)

Open-source bot with 13 strategies. Edit it with ChatGPT/Claude — no coding. Free, no spam.

Get the bot

Does Deriv have an official API?

Yes — that's the big advantage. Deriv offers an official WebSocket API with token login (created in the API token section of your Deriv account). It's stable, legal and works with Python — which is why the Deriv bot is the most reliable of the three.

3 ways to build a Deriv bot

• Deriv Bot (DBot) — visual blocks in the browser, no code. Best to start.
• Python API — full control via WebSocket (proposal → buy → result). What our bot uses.
• MT5 (Expert Advisor) — for EAs with MQL5/AI.

Careful with synthetic indices

The ready-made bot (free)

The IaTraderPro Bot already connects to Deriv's official API, ships 13 strategies, a payout filter, daily stop loss/win and a visual dashboard. Open source — read and change the code by chatting with ChatGPT or Claude.

→ Quotex bot · → IQ Option bot

Deriv's new Options API (2026) — and why it changes the game

Deriv is the only broker on this list with an official API — and in 2026 it launched the new Options API. Our bot already runs on it in production. What we learned hands-on:

• Token authentication (prefix pat_), created in Deriv's dashboard with trade permission — no password in code, far safer than browser login.
• REAL results and payout from the API — no guessing outcomes from candles: the broker officially reports each contract.
• Real forex has a 15-minute minimum duration; the 1-hour contract pays ~78–82% (break-even ≈ 56% accuracy).
• A demo (Virtual) account lets you test everything risk-free.

Automation on an official API = no ban risk and nothing breaks when the platform updates. If you want a reliable robot running 24/5, Deriv is technically the most solid choice today.

How the official Deriv API works in 2026 (from the docs)

If you read a Deriv bot tutorial from 2023 or 2024, the connection flow it describes is probably outdated. In the current Deriv API documentation (checked in September 2026), a bot talks to Deriv in two layers: REST for account setup and WebSocket for prices and trades.

Step	What happens	Detail from the docs
1. Authenticate	The bot sends a Bearer token to the REST base https://api.derivws.com	OAuth 2.0 (web apps) or a Personal Access Token (desktop apps). With a PAT, the Deriv-App-ID header is mandatory on REST requests
2. Get a one-time password	POST /trading/v1/options/accounts/{accountId}/otp	Requires the trade scope. The OTP is valid for 120 seconds and works only once
3. Open the WebSocket	Demo: …/options/ws/demo?otp=… · Real: …/options/ws/real?otp=…	Demo and real are separate endpoints, so the account type is chosen explicitly
4. Trade	Proposal → buy → contract updates on the same connection	Public market data also has an endpoint with no login (…/ws/public)

The OTP detail matters in practice: if your bot fetches the OTP and then spends more than two minutes loading history before connecting, the login fails. Fetch it right before opening the socket (WebSocket docs). The docs also keep an "Options Trading (Legacy)" section, which now only gives read-only access to pre-upgrade history of migrated accounts. If a tutorial never mentions api.derivws.com or an OTP, compare it with the current docs before copying code.

Rate limits (September 2026)

Deriv published its API limits on one page. The numbers a trading bot actually hits:

Call group	Per minute	Per hour
proposal, proposal_open_contract, buy, sell	360	14,400
balance, statement	100	2,000
portfolio, profit_table	30	1,500
All other WebSocket calls	220	14,400
REST, logged-in user	80	—

A bot watching 3 pairs and placing a few trades per hour uses a tiny fraction of this. Bots get blocked when they poll: asking for the balance every second burns the 100/minute budget in under two minutes. The docs recommend subscribing to streams, reusing one connection and backing off (1 s, 2 s, 4 s, 8 s…) after a rejection (best practices).

Creating a token with the minimum permission

A token is a key to your account, so give it only what the bot needs. Deriv's own help article describes the flow: open the API token section in your Deriv dashboard or account settings, select the scopes, type a name and click Create. The scopes listed in the OAuth docs are:

Scope	What it allows (per Deriv)	Does a trading bot need it?
trade	Trading operations	Yes — the only one required (the OTP endpoint asks for it)
account_manage	Creating and managing accounts	No
application_read	Reading your registered applications	No
payment	Payment agent deposits and withdrawals	Never for a bot

1. Start on the demo account: the docs say every user gets a default demo account at signup.
2. Create one token per device and name it so you can recognise it later (for example bot-home-pc).
3. Tick only trade. If a tool or "free bot" asks for more, treat that as a warning sign.
4. Copy the token once, keep it in the bot's local config and nowhere else.
5. Revoke it the moment you stop using the bot or suspect it leaked — tokens are independently revocable.

Common leak: you paste config_bot.ini or bot.py into ChatGPT or Claude to change a strategy — with the token inside. Delete the token line before pasting, and never commit it to a public GitHub repository.

Deriv Bot (DBot) vs a Python bot: which one fits you

	Deriv Bot (official, visual)	Python bot via API (like IaTraderPro)
Where it runs	In the browser, inside your logged-in Deriv session	On your computer, connected with a token
How you build it	Drag-and-drop blocks; bots saved and loaded as XML files	Code (editable with an AI assistant)
Ready-made strategies	Quick Strategies: Martingale, D'Alembert, Oscar's Grind	13 signal strategies + stops, cooldown, payout filter
How you test it	On the free demo account, as Deriv recommends	Demo account, plus simular_csv.py to backtest a strategy over a CSV of candles
Best for	Learning how contracts and stakes work	Testing a signal logic with statistics, several pairs at once

Note what the three Quick Strategies are: stake progressions, not entry signals. They decide how much to bet after a win or loss, not whether the price will go up. As our martingale test shows, changing the stake size does not create an edge — it only changes how fast the balance moves. Sources: Deriv Bot page and Deriv Bot help centre.

What our bot does with Deriv, step by step

1. Reads candles for up to 3 pairs and runs the strategies you enabled (in individual or maioria voting mode).
2. Checks the payout offered; if it is below payout_min, it skips the signal.
3. Requests a proposal, buys the contract and waits for the official result reported by Deriv.
4. Logs the trade in the panel and applies daily stop loss/stop win, cooldown after losses and, only if you turn it on, martingale.

An honest limitation: our strategy study measured M1 candles from the Deriv feed with 1–2 candle expiries, where Double Reversal reached ~57–61% out-of-sample. On Deriv, real forex contracts have a 15-minute minimum duration, so that M1 edge does not transfer automatically. Test on demo with the same duration you will trade.

The math you need to beat: break-even accuracy = 1 / (1 + payout). With the ~78–82% payout of the 1-hour contract, break-even is 56.2%–54.9%. At 80% payout and 57% accuracy, the expectation is 0.57 × 0.80 − 0.43 = +$0.026 per $1 staked; at 55% it becomes 0.44 − 0.45 = −$0.01. Two percentage points separate a small edge from a slow loss.

"Free Deriv bots" in XML files: what can go wrong

Telegram groups, YouTube descriptions and GitHub repositories share DBot XML files promising 90%+ win rates, often with a "premium version" sold over WhatsApp. An XML file loaded into Deriv Bot runs with your balance, inside your session. The usual problems:

• Hidden martingale. A block multiplies the stake after each loss (×2, ×2.1…). Six losses in a row turn a $1 start into a $64 bet.
• No real stop. The "trade again" loop has no loss limit, or the limit is set so high it never triggers.
• Win rate shown on synthetic indices or demo. Volatility indices are random by design; a good screenshot there proves nothing.
• Token phishing. "Paste your API token to activate the bot" on a third-party site. With trade they can trade your balance; with payment, far worse.

Before running any XML: open it in the DBot workspace and read every block, look for stake multipliers and the stop condition, then run it on demo for at least 150 trades. For account safety topics, see Deriv's fraud prevention FAQ.

Security checklist before you automate

• Token with trade scope only — never payment or account_manage.
• One token per device, with a recognisable name; revoke unused ones.
• Token never pasted into chats, AI prompts, screenshots or public repositories.
• You got the bot's code from a source you can read (open source), not an executable from a stranger.
• First run on the demo endpoint; the real account only after the criteria in our demo guide.
• stop_loss_dia filled in and martingale = nao until you have data showing otherwise.
• payout_min set so that your measured accuracy stays above break-even.
• No XML or "signal service" that you have not read and tested yourself.

⚠️ Trading involves high risk of loss. Educational content, not investment advice. No bot guarantees profit. Always test on a demo account.