Quick Start¶

Install the gateway, complete your first login, and read its state from your own computer. The verification requests on this page are read-only and do not require trade unlock.

1. Install¶

Homebrew (macOS / Linux)Manual download

brew install futuleaf/tap/futu-opend-rs
futu-opend --version

All four programs are installed on PATH. Use futu-opend and futucli directly in the following steps, without ./.

Choose your platform on the download page, download and verify the archive, then extract it. Keep all four programs together, including futu-indicator-worker, which the gateway starts when needed.

Linux x86_64 example: v1.9.7 archive and SHA-256 sidecar. See the download page for other platforms.

On macOS / Linux, run export PATH="$PWD:$PATH" from the extracted directory to use the commands below. This applies only to that terminal; set it again in a new terminal or use absolute program paths.

On Windows, open PowerShell in the extracted directory and replace futu-opend below with .\futu-opend.exe. Put multiline arguments on one line and use curl.exe for the HTTP checks.

2. Complete your first login¶

Prepare your login account. On macOS or Linux, create a password file readable only by your user. The prompt does not echo your password or place it in shell history:

install -d -m 700 "$HOME/.config/futu"
printf 'Login password: '; IFS= read -rs futu_login_password; echo
umask 077
printf '%s\n' "$futu_login_password" > "$HOME/.config/futu/login-pwd"
unset futu_login_password
chmod 600 "$HOME/.config/futu/login-pwd"

Run this in a foreground terminal, replacing YOUR_LOGIN_ACCOUNT with your account. On Windows, create a password file under your user profile and use its full path in place of the path shown here.

futu-opend --setup-only \
  --login-account YOUR_LOGIN_ACCOUNT \
  --login-pwd-file "$HOME/.config/futu/login-pwd"

Follow any prompts for device confirmation or SMS verification. --setup-only exits after verification and credential caching; it does not start API services. For moomoo accounts, add --platform moomoo to both this command and the startup command below. See the launch cheatsheet for other login options.

Use the same operating-system user and HOME for subsequent starts so the gateway can read the device and credential state created here. If credentials expire or verification is required again, return to a foreground terminal and follow the prompts.

3. Start and check read access¶

Start the gateway and leave this terminal running:

futu-opend \
  --login-account YOUR_LOGIN_ACCOUNT \
  --login-pwd-file "$HOME/.config/futu/login-pwd" \
  --ip 127.0.0.1 \
  --port 11111 \
  --rest-port 22222

--ip 127.0.0.1 binds the interfaces to your computer; --rest-port explicitly enables REST. This example uses local HTTP without API keys and sends no Bearer token. This mode does not enforce read-only permissions: the requests on this page are reads. Configure authentication in the next section before sharing access with other clients.

In another terminal, run:

curl --fail-with-body http://127.0.0.1:22222/livez
curl --fail-with-body http://127.0.0.1:22222/readyz
curl --fail-with-body http://127.0.0.1:22222/api/global-state

/livez checks whether the process is alive.
/readyz checks whether the gateway is ready to handle requests. If it is not ready, check the startup terminal for guidance.
/api/global-state reads global state. Inspect the business response as well as the HTTP status; connectivity alone does not confirm login or business-call success.

If the connection is refused, confirm that the process is running, REST is enabled, and the ports match. Find more diagnostics in Operations.

4. Configure access¶

The API Key tutorial covers key creation, read-only scopes, and HTTPS configuration. Complete those steps before allowing other programs or remote clients to access the gateway.

5. Choose an integration¶

Your goal	Next step
Give an AI assistant access to quotes and accounts	MCP integration
Develop with REST, CLI, gRPC, or WebSocket	Integration guides
Follow a scenario step by step	Tutorials

6. Deploy and operate¶

After the local read succeeds, continue to Operations for deployment, health checks, and troubleshooting. Before running as a service, complete the first login with the service's user and HOME.

In REST scope mode, /metrics requires an Authorization: Bearer token with metrics:read (or admin) by default.

Where to next¶

Choose an integration · Downloads and updates · Explore use cases