Tachibana Securities' incoming passkey requirement does not, by itself, require a fingerprint for every automated API order. Its published instructions separate human website sign-in from API authentication: the user enters the standard website using a passkey, enables API access, and sets up an authentication ID and cryptographic keys. Developers should check for any further API-specific rules before December 2026.[1][2]
Now picture a trading bot detecting a perfect buy signal at 2 a.m. Instead of sending the order, it wakes its owner: “Could you lend me a thumb?”
You built a fully automated trading system and somehow got hired as its overnight fingerprint operator.
Two doors, two kinds of credentials
The company's API instructions say users first sign into the website with a passkey, then turn on API usage and configure their credentials. The API design uses public-key cryptography.[2]
“The website requires a passkey” is a very different statement from “every software order requires live biometric approval.” Combine them carelessly and the robot becomes a fancy alarm clock.
What changes on December 12 and 18?
Following maintenance on December 12, 2026, trading and withdrawals through the smartphone-specific website will require a passkey. Without registration, phone verification permits only certain balance inquiries. Following scheduled maintenance on December 18, the standard website is set to accept passkey sign-ins only.[1]
That is the published timetable for the listed web interfaces. It does not settle every technical detail of future API requests.
There is a separate software compatibility question, too: API v4r10 was released on August 29, and the company announced v4r9's retirement on September 27. An obsolete endpoint is not a biometric-login problem.[3]
The punchline: the shop is closed while we debate its lock
Tachibana's website says the production API, demo API, and several other services have been suspended since October 23, 2026, at 3:30 p.m. Japan time because of what the company calls a “PHP issue.” As of the October 29 check, no reopening date was displayed.[4]
We've spent ages discussing whether the robot needs a digital door key. The robot arrives and finds a sign that says CLOSED.
The notice also names BRiSK Next, the price board, and the mobile website. So an unavailable API should not automatically be diagnosed as an incorrectly registered passkey.
How to bring the bot back safely
First check the official restoration announcement. Then verify the API version, website passkey registration, API activation, and cryptographic credentials. Once service returns, test connectivity and order-status queries before allowing unattended orders.
A connection failure after submission is especially dangerous: the first order may already have arrived. Verify its status before retrying, prevent duplicates, and arrange for the system to stop new orders if necessary.
Bottom line: passkeys for the human website setup and credentials for the program have different jobs. On October 29, 2026, the immediate obstacle is the official API outage, not a demand for robotic fingerprints.
The most useful automation today might be a bot that reads service notices.
Official sources
References (4)
- Tachibana Securities, December passkey schedule e-shiten.jp
- Tachibana Securities, public-key API authentication e-shiten.jp
- Tachibana Securities, API v4r10 release e-shiten.jp
- Tachibana Securities, service suspension notice e-shiten.jp
