Short Grant Code | NinjaTrader Partner API

Mint a single-use code that signs one of your users into a NinjaTrader-hosted page.

Available to: Trader users of a configured NT Connect partner organization

Environments: Live. The endpoint is not blocked on Demo, but partner mode depends on a partner configuration, and those are provisioned on Live.

Rate Limit: No endpoint-specific time penalty. Partner-mode requests are limited per partner organization: 1,000 requests per hour by default, measured over a sliding window.

Use this endpoint when a user is already signed in to your application and you want to send their browser to a NinjaTrader-hosted URL (the trader dashboard, an account page, a funding page) without a second login.

Your backend calls this endpoint with the partner access token it already holds for that user (minted with the urn:ietf:params:oauth:grant-type:jwt-bearer grant on oAuthToken). NinjaTrader returns a short-lived, single-use code. You then redirect the user’s browser to the NinjaTrader application with that code attached, and exchangeShortGrantCode redeems it on arrival.

The partner access token never leaves your backend. Only the short code travels through the browser.

The handoff runs in three steps:

Your backend posts to /auth/shortgrantcode with the partner access token.
NinjaTrader returns code and expires_in.
Your backend redirects the user’s browser to the NinjaTrader application with the code attached, and the application redeems it.

Warning: This endpoint returns HTTP 200 for successes and for policy rejections. Always check the errorText field in the response body to determine whether the request succeeded or failed.

Partner Mode and expectedClientIp

expectedClientIp is what selects partner mode, and it is the field that makes the flow work end to end. Send the end user’s IP address as resolved by your own load-balancer-aware logic. The code is then bound to that address and redemption is rejected from anywhere else.

Omitting expectedClientIp does not return an error. The request silently falls back to the non-partner path, which binds the code to your backend’s IP address instead of the user’s, so the redirect fails at redemption with "Access denied from another IP". Always send it.

In partner mode the caller must be a trader user belonging to an organization that has an enabled, non-archived partner configuration. Organization administrators and non-trader accounts are rejected.

Code Lifetime

ttl is a request, not a guarantee. The server clamps it to the per-environment maximum (30 seconds in production), and the response’s expires_in carries the value actually stored. Omitting ttl, or sending a value of zero or less, gives 15 seconds.

Mint the code at the moment you are ready to redirect, not in advance. Only one code exists per user at a time: minting a second code invalidates the first.

Response Fields

The response is an OAuthGrantResponse. Two fields matter for this flow:

code: the single-use code. Attach it to the NinjaTrader URL you redirect the user to.
expires_in: the code’s lifetime in seconds, after clamping. Note the underscore: the JSON key is expires_in, not expiresIn.

The idToken field is never populated by this endpoint.

Sample Call

$ CODE=$(curl -sS -X POST "https://live.tradovateapi.com/v1/auth/shortgrantcode" \
>   -H "Authorization: Bearer $PARTNER_ACCESS_TOKEN" \
>   -H "Content-Type: application/json" \
>   -d "{\"ttl\": 30, \"expectedClientIp\": \"$END_USER_IP\"}" \
>   | jq -r .code)
$ 
$ # Redirect the user's browser to the NinjaTrader application with the code attached.

1 {
2   "code": "…",
3   "expires_in": 30
4 }

Common Failure Scenarios

expectedClientIp is omitted, so the code is bound to your backend’s address instead of the user’s.
expectedClientIp is not a valid IPv4 or IPv6 address, or exceeds 64 characters. Both are request-validation failures, so they return HTTP 400 with a field-violation body rather than the HTTP 200 shape below.
The caller’s organization has no partner configuration, or that configuration is disabled or archived.
The caller is an organization administrator or a non-trader account.
The access token is missing or expired (returns HTTP 401, plain-text body).
The organization exceeded its hourly quota (returns HTTP 429, plain-text body).
The code was minted too early and expired before the user’s browser reached NinjaTrader.

Error Messages

Response	Trigger
`errorText: "Short grant codes are not available for this account"`	Any partner-policy rejection: no partner configuration, configuration disabled or archived, caller is an organization administrator, or caller is not a trader. The specific reason is deliberately not disclosed.
`HTTP 429` `Partner short grant code rate limit exceeded`	The organization exceeded its hourly quota. The body is plain text, not JSON.
`HTTP 401`	The access token is missing, invalid, or expired. The body is plain text, not JSON.

### Mint a single-use code that signs one of your users into a NinjaTrader-hosted page. **Available to:** Trader users of a configured NT Connect partner organization **Environments:** Live. The endpoint is not blocked on Demo, but partner mode depends on a partner configuration, and those are provisioned on Live. **[Rate Limit](/overview/core-concepts/rate-limits):** No endpoint-specific time penalty. Partner-mode requests are limited per partner organization: 1,000 requests per hour by default, measured over a sliding window. Use this endpoint when a user is already signed in to your application and you want to send their browser to a NinjaTrader-hosted URL (the trader dashboard, an account page, a funding page) without a second login. Your backend calls this endpoint with the partner access token it already holds for that user (minted with the `urn:ietf:params:oauth:grant-type:jwt-bearer` grant on [`oAuthToken`](/api/rest-api-endpoints/authentication/o-auth-token)). NinjaTrader returns a short-lived, single-use code. You then redirect the user's browser to the NinjaTrader application with that code attached, and [`exchangeShortGrantCode`](/api/rest-api-endpoints/authentication/exchange-short-grant-code) redeems it on arrival. **The partner access token never leaves your backend.** Only the short code travels through the browser. The handoff runs in three steps: 1. Your backend posts to `/auth/shortgrantcode` with the partner access token. 2. NinjaTrader returns `code` and `expires_in`. 3. Your backend redirects the user's browser to the NinjaTrader application with the code attached, and the application redeems it. <Warning>**Warning:** This endpoint returns **HTTP 200** for successes **and** for policy rejections. Always check the `errorText` field in the response body to determine whether the request succeeded or failed.</Warning> **Partner Mode and `expectedClientIp`** `expectedClientIp` is what selects partner mode, and it is the field that makes the flow work end to end. Send the end user's IP address as resolved by your own load-balancer-aware logic. The code is then bound to that address and redemption is rejected from anywhere else. <Info>Omitting `expectedClientIp` does not return an error. The request silently falls back to the non-partner path, which binds the code to **your backend's** IP address instead of the user's, so the redirect fails at redemption with `"Access denied from another IP"`. Always send it.</Info> In partner mode the caller must be a trader user belonging to an organization that has an enabled, non-archived partner configuration. Organization administrators and non-trader accounts are rejected. **Code Lifetime** `ttl` is a request, not a guarantee. The server clamps it to the per-environment maximum (**30 seconds in production**), and the response's `expires_in` carries the value actually stored. Omitting `ttl`, or sending a value of zero or less, gives 15 seconds. Mint the code at the moment you are ready to redirect, not in advance. Only one code exists per user at a time: minting a second code invalidates the first. **Response Fields** The response is an `OAuthGrantResponse`. Two fields matter for this flow: - `code`: the single-use code. Attach it to the NinjaTrader URL you redirect the user to. - `expires_in`: the code's lifetime in seconds, after clamping. Note the underscore: the JSON key is `expires_in`, not `expiresIn`. The `idToken` field is never populated by this endpoint. **Sample Call** ```bash CODE=$(curl -sS -X POST "https://live.tradovateapi.com/v1/auth/shortgrantcode" \ -H "Authorization: Bearer $PARTNER_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"ttl\": 30, \"expectedClientIp\": \"$END_USER_IP\"}" \ | jq -r .code) # Redirect the user's browser to the NinjaTrader application with the code attached. ``` ```json { "code": "…", "expires_in": 30 } ``` **Common Failure Scenarios** - `expectedClientIp` is omitted, so the code is bound to your backend's address instead of the user's. - `expectedClientIp` is not a valid IPv4 or IPv6 address, or exceeds 64 characters. Both are request-validation failures, so they return `HTTP 400` with a field-violation body rather than the `HTTP 200` shape below. - The caller's organization has no partner configuration, or that configuration is disabled or archived. - The caller is an organization administrator or a non-trader account. - The access token is missing or expired (returns `HTTP 401`, plain-text body). - The organization exceeded its hourly quota (returns `HTTP 429`, plain-text body). - The code was minted too early and expired before the user's browser reached NinjaTrader. **Error Messages** | Response | Trigger | |----------|---------| | `errorText: "Short grant codes are not available for this account"` | Any partner-policy rejection: no partner configuration, configuration disabled or archived, caller is an organization administrator, or caller is not a trader. The specific reason is deliberately not disclosed. | | `HTTP 429` `Partner short grant code rate limit exceeded` | The organization exceeded its hourly quota. The body is plain text, not JSON. | | `HTTP 401` | The access token is missing, invalid, or expired. The body is plain text, not JSON. |

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Request

This endpoint expects an object.

ttlintegerOptional

expectedClientIpstringOptional<=64 characters

Response

OAuthGrantResponse

errorTextstringOptional<=8192 characters

Non-empty if the request failed

codestringOptional<=8192 characters

expires_inintegerOptional

idTokenstringOptional<=8192 characters

CODE=$(curl -sS -X POST "https://live.tradovateapi.com/v1/auth/shortgrantcode" \
  -H "Authorization: Bearer $PARTNER_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"ttl\": 30, \"expectedClientIp\": \"$END_USER_IP\"}" \
  | jq -r .code)
# Redirect the user's browser to the NinjaTrader application with the code attached.

Response

Trigger

errorText: "Short grant codes are not available for this account"

Any partner-policy rejection: no partner configuration, configuration disabled or archived, caller is an organization administrator, or caller is not a trader. The specific reason is deliberately not disclosed.

HTTP 429 Partner short grant code rate limit exceeded

The organization exceeded its hourly quota. The body is plain text, not JSON.

HTTP 401

The access token is missing, invalid, or expired. The body is plain text, not JSON.

$	curl -X POST https://live.tradovateapi.com/v1/auth/shortgrantcode \
>	-H "Authorization: Bearer <token>" \
>	-H "Content-Type: application/json" \
>	-d '{}'

1	{
2	"errorText": "string",
3	"code": "string",
4	"expires_in": 1,
5	"idToken": "string"
6	}

$	CODE=$(curl -sS -X POST "https://live.tradovateapi.com/v1/auth/shortgrantcode" \
>	-H "Authorization: Bearer $PARTNER_ACCESS_TOKEN" \
>	-H "Content-Type: application/json" \
>	-d "{\"ttl\": 30, \"expectedClientIp\": \"$END_USER_IP\"}" \
>	\| jq -r .code)
$
$	# Redirect the user's browser to the NinjaTrader application with the code attached.