For your MT5 administrator
What GarnetSync asks of your MT5 server.
One manager account of its own, with no delete, Configuration or Administration rights. Our fixed IP on its allow-list. Your demo groups first. And a secure page where you enter the login yourself, so its password never passes through email or chat.
Enter the connection details
The password is encrypted as soon as it arrives and is never shown again, to anyone. Never send it by email or chat.
Access server address
Port
Manager login
API password
Connected to mt.corvanemarkets.com
Signed in as manager 5001, and the server proved it knows the password too. This link is closed now.
The checklist
7 steps in MetaTrader 5 Administrator.
The labels are MT5 Administrator's own (build 6230). The same steps appear on the brand page, in the email and on the setup page.
- 01
Create a manager account just for the CRM: an account in a managers group under Clients & Accountsthen Trading Accounts, its API password set on its Security tab, then added in Managers. Its own login means it can be limited, audited and switched off without touching anyone else's access.
WhyName it neutrally: nothing GarnetSync creates on your server carries our name. Deal comments read like Deposit #7F3K9QX2M4PA.
- 02
In its Permissions, tick Connect using MetaTrader 5 Manager; under Accounts, Access accounts, Edit accounts, Accountant (balance operations) and Access personal details (Name, Location, Address, Email, Phone, General); under Dealing, Access orders and positions.
WhyExactly what the CRM does: open and update accounts, post deposits and withdrawals, read deals and positions, and show the client details it needs.
- 03
Tick Dealingthen Dealer as well if your team will close positions, change stop loss and take profit, or cancel orders from the trading desk.
WhyOnly for the trading desk's dealer requests, which run on demo accounts today. Every close takes a fresh authenticator code.
- 04
Leave everything else off: every delete right, Configuration setup and Administration. Never pick a Role in that dialog: it replaces every tick with the role's own.
WhyWithout delete rights, nothing on your server can be removed through this login. Without Configuration or Administration, it can't change your set-up or who can reach it.
- 05
Let it work with your demo groups first. Add real groups on purpose when you go live, so setup and testing never move real money.
WhySetup and testing never move real money. Two brands may share a server, and the desk keeps to each brand's own groups.
- 06
Add our fixed IP address to its IP access list. MT5 refuses the manager login from anywhere else.
WhyWe give you the address: it's in the email, and on the setup page.
- 07
Make sure the access server accepts Web API connections over HTTPS, at a name with a valid certificate (for example mt.yourbroker.com).
WhyA real certificate lets GarnetSync verify it's talking to your server. The Web API doesn't work over plain HTTP.
What this login can do
Each right, and how you'll know it works.
MT5 can't be asked for a manager's rights without trying, and GarnetSync never tries a write just to find out. So the brand page shows each one as it's first used.
- Seen working
- MT5 refused it, with the right to tick
- Not tried yet
| What GarnetSync does | The right it needs | When you'll know |
|---|---|---|
| See accounts, balances and deals | Accountsthen Access accounts | The connection test reads them. |
| See open positions and orders | Dealingthen Access orders and positions | The bridge's mirror reads them. |
| Post deposits, withdrawals and credit | Accountsthen Accountant (balance operations) | The first deposit, withdrawal or credit it sends. |
| Change leverage, group, sign-in, trading and archive | Accountsthen Edit accounts | The first account change it makes. |
| Close positions, change stop loss and take profit, cancel orders | Dealingthen Dealer | The first dealer request from the desk. |
On the network
One address, one login, nothing installed.
How GarnetSync reaches your access server, and how it behaves when it can't.
- HTTPS, with a real certificate
- The Web API at a name with a valid certificate, for example mt.yourbroker.com on port 443.
- One fixed IP
- GarnetSync connects from one fixed address. Add it to the manager's IP access list, and MT5 refuses the login from anywhere else.
- A sign-in that works both ways
- GarnetSync checks that your server knows the password too, so it knows it's talking to yours.
- Nothing installed
- No plugin on your server. GarnetSync works through the Web API and the manager account alone.
- Lock-out safe
- A refused sign-in is never retried until someone saves the connection again: each try counts against your server's own brute-force protection. An unreachable server is retried after 1, 2, 5, 10 and 30 seconds, then every minute.
- A test that writes nothing
- Saving signs in and counts the groups, symbols and accounts the login can see. Within seconds the bridge signs in with the same login and keeps its session open.
Send these steps to your MT5 administrator
The password goes from you to GarnetSync, and nowhere else.
If the owner of the brokerage isn't the person with MT5 Administrator open, one button on the brand page sends that person everything above, and a link to a page of their own.
- 01
The owner sends it
From the brand page, with a fresh authenticator code, to your name and email address.
- 02
You get the steps and a link
This checklist, our IP address, and a link to a secure page.
- 03
You enter the login
The access server address, port, manager login and API password. The password is encrypted as it arrives.
- 04
It tests, then closes
You see the result at once. The owner is emailed when it connects, and the link stops working.
- 72 hours
- before the link expires
- 10 tries
- each failed sign-in counted on your lock-out
- 1 open link
- per brand: a new one replaces the last
- Cancel
- the owner can call it back at any time
Questions
From MT5 administrators, answered.
Do you need an administrator or root login?
No. Only the manager account you create for the CRM, with the rights above, and you can enter its password yourself on the setup page.
Why never pick a Role for this manager?
In that dialog, a Role replaces every tick with the role's own, so the login would end up with rights the checklist leaves off.
What happens if we take a right away later?
MT5 refuses the next action that needs it with 'Not enough permissions', and What this login can do shows it refused, with the right to tick.
Can we switch GarnetSync off without touching anyone else?
Yes. It's a login of its own: disable it, and GarnetSync stops while everyone else's access stays exactly as it was.
Is there a public API or webhooks?
Not today. GarnetSync talks to your MT5 server and to the providers built into it. If you need something else connected, talk to our team.
Where to next
Questions about your server?
Our team answers integration questions before you tick a single box, and walks your administrator through the checklist if you'd like.