O Auth Token

Exchange a credential for an access token.

Available to: Registered OAuth client applications and NT Connect partners

Environments: Demo, Live. The jwt-bearer grant is Live in practice, because partner configurations are provisioned there.

Rate Limit: 10 requests per hour, 30-second back-off, counts failed requests only. OAuth errors are returned as HTTP 200 and are not failures for this purpose, so only transport-level failures count toward the penalty.

Select a grant with grant_type; which of the other request fields apply depends on the grant you choose.

Authenticate the client with client_id and client_secret in the body, or with httpAuth (base64 client_id:client_secret). Public clients use PKCE and send code_verifier instead of a secret. For the authorization-code flow, see the OAuth JavaScript tutorial.

Partner SSO: the jwt-bearer Grant

NT Connect partners exchange a short-lived JWT, signed with their registered key, for a NinjaTrader access token scoped to one of their users. No user password is involved and no NinjaTrader login prompt is shown.

Assertion Requirements

The assertion must be signed with RS256 and carry a kid header identifying the signing key. Required claims:

Clock skew of up to 60 seconds is tolerated on the time claims. Any additional claims you include are ignored.

Signing Keys

NinjaTrader fetches your public keys from the JWKS URL on your partner configuration and caches them for one hour. A key rotation is picked up automatically the first time an assertion arrives with a kid that is not in the cache, so publish the new key before you start signing with it.

Sample Call

curl -X POST 'https://live.tradovateapi.com/v1/auth/oauthtoken' \
  -H 'Content-Type: application/json' \
  -d '{
        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "assertion": "<your-signed-jwt>"
      }'

{
  "access_token": "…",
  "refresh_token": "…",
  "token_type": "bearer",
  "expires_in": 86400,
  "refresh_token_expires_in": 93600
}

Scopes

The resulting token carries the scopes configured on your partner client application, intersected with the scopes the user has granted. A user who has revoked your application is rejected with access_denied.

Refresh Token Behavior

Refresh tokens are single-use and rotate: each refresh consumes the current token and returns a new one. Because a partner session is keyed on the partner and the user rather than on a device, a new jwt-bearer exchange replaces the refresh token issued by the previous exchange for that same user. Keep the most recent token pair, or re-run the exchange, rather than holding several in parallel.

Signing a User Into a NinjaTrader-Hosted Page

To hand a signed-in user off to a NinjaTrader-hosted page, use the partner access token from this endpoint to mint a short-lived code with shortGrantCode, then redirect the user’s browser with that code attached. The access token itself never leaves your backend. The NinjaTrader application redeems the code with exchangeShortGrantCode.

Common Failure Scenarios

• The assertion is signed with an algorithm other than RS256, or omits the kid header.
• iss or aud does not exactly match the values registered on the partner configuration.
• The assertion lifetime exceeds 300 seconds.
• The same jti was already used.
• sub does not resolve to an active user in your organization.
• The partner configuration is disabled or archived.
• assertion is missing on a jwt-bearer call, which matches no grant shape and returns bad_request.

Error Messages