Class CASClient

CAS authentication client for XTB xStation5.

Flow:

login(email, password) → TGT (Ticket Granting Ticket)
getServiceTicket(tgt, 'xapi5') → ST (Service Ticket)
Use ST with WebSocket loginWithServiceTicket

Critical: Use service='xapi5' for WebSocket, NOT 'abigail' (that's for REST API)

Index

Constructors

Methods

getServiceTicket getServiceTicketV2 getTgtFromResult isTgtValid login loginWithTwoFactor refreshServiceTicket

Constructors

constructor

new CASClient(config?: CASClientConfig): CASClient
Parameters
- config: CASClientConfig = {}
Returns CASClient
- Defined in src/auth/cas-client.ts:38

Methods

getServiceTicket

getServiceTicket(tgt: string, service?: string): Promise<CASServiceTicketResult>
Get Service Ticket using TGT. Uses CAS v1 endpoint by default (compatible with both real and demo).
Parameters
- tgt: string
  Ticket Granting Ticket from login()
- service: string = 'xapi5'
  Service name. Use 'xapi5' for WebSocket, 'abigail' for REST API
Returns Promise<CASServiceTicketResult>
Service ticket for the specified service
- Defined in src/auth/cas-client.ts:278

getServiceTicketV2

getServiceTicketV2(
tgt: string,
service?: string,
): Promise<CASServiceTicketResult>
Get Service Ticket via CAS v2 endpoint (alternative method). POST https://xstation.xtb.com/signon/v2/serviceTicket JSON: {tgt, service: "xapi5"} + Time-Zone header
Parameters
- tgt: string
- service: string = 'xapi5'
Returns Promise<CASServiceTicketResult>
- Defined in src/auth/cas-client.ts:323

getTgtFromResult

getTgtFromResult(loginResult: CASLoginResult): string | null
Extract TGT from successful login result.
Parameters
- loginResult: CASLoginResult
  Result from login() method
Returns string | null
TGT string if login was successful, null if 2FA required
- Defined in src/auth/cas-client.ts:393

isTgtValid

isTgtValid(tgtResult: CASLoginResult): boolean
Check if TGT is still valid (not expired). Note: This only checks local expiration time, not server-side validity.
Parameters
- tgtResult: CASLoginResult
Returns boolean
- Defined in src/auth/cas-client.ts:384

login(email: string, password: string): Promise<CASLoginResult>
Login with email/password using CAS v2 with v1 fallback.

Tries CAS v2 first (supports 2FA), falls back to CAS v1 (no 2FA) if v2 unavailable.
Parameters
- email: string
  XTB account email
- password: string
  XTB account password
Returns Promise<CASLoginResult>
Either success with TGT or 2FA challenge requiring OTP code

Throws
CASError if credentials invalid, account blocked, or service unavailable
- Defined in src/auth/cas-client.ts:57

loginWithTwoFactor

loginWithTwoFactor(sessionId: string, code: string): Promise<CASLoginResult>
Submit two-factor authentication code to complete login.
Parameters
- sessionId: string
  Session ID from initial login response
- code: string
  OTP code (6 digits from TOTP/SMS/EMAIL)
Returns Promise<CASLoginResult>
TGT and expiration timestamp if successful, or new 2FA challenge

Throws
CASError if code is invalid, rate limited, or account blocked
- Defined in src/auth/cas-client.ts:223

refreshServiceTicket

refreshServiceTicket(tgt: string, service?: string): Promise<string>
Refresh service ticket using existing TGT.

Service tickets are single-use and expire after 2-5 minutes. Use this method to get a fresh ST when the previous one is expired.
Parameters
- tgt: string
  Valid Ticket Granting Ticket
- service: string = 'xapi5'
  Service name (default: 'xapi5')
Returns Promise<string>
Fresh service ticket

Throws
CASError if TGT is invalid or expired
- Defined in src/auth/cas-client.ts:368