Skip to navigation

Access Token Request

View as Markdown

Request an access token using your user credentials and API Key.

See the Authentication section for more details.

Acquiring an Access Token

const URL = 'https://live.tradovateapi.com/v1'
const credentials = {
name: "Your credentials here",
password: "Your credentials here",
appId: "Sample App",
appVersion: "1.0",
cid: 0,
sec: "Your API secret here"
}
async function getAccessToken() {
let response = await fetch(URL + '/auth/accessTokenRequest', {
method: 'POST',
headers: {
'Content-Type': 'application/json'
}
})
let result = await response.json()
return result // { accessToken, mdAccessToken, userId, ... }
}
//...
async function main() {
const { accessToken, mdAccessToken, userId } = await getAccessToken()
//use access token
}

Using an Access Token

//use the Authorization: Bearer schema in API POST and GET requests
//simple /account/list endpoint requires no body or query
async function getAccounts() {
let response = await fetch(URL + '/account/list', {
method: 'GET',
headers: {
'Content-Type': 'application/json',
Authorization: `Bearer ${accessToken}` //Access Token use in HTTP requests
}
})
let result = await response.json()
return result
}

Expiration and Renewal

Access tokens expire after 80 minutes. Each token response includes an expirationTime field with the exact expiry time. Renew by calling renewAccessToken with your current token before it expires.

Other Important Notes

Calling the accessTokenRequest endpoint successfully will start a new session on our servers. This session is tracked, and you are limited to two concurrent sessions. Once a third (or additional) session is created, the oldest sessions are closed. This can be problematic in the following situations:

SituationProblemSolution
You have many services that don’t share a central point of access, and each request their own sessions via auth/accessTokenRequest.Your oldest sessions will be closed, and subsequent calls using the old access tokens will throw 408, 429, or 500 level errors.Create a service to manage the access token, then distribute the identical valid token to dependent services
You log on to .tradovate.com websites with your API user while running two or more API-powered applications.Your API application risks being booted after a few of these spontaneous logins.Your API user should be a dedicated user that doesn’t require more than two concurrent logins.
You call auth/accessTokenRequest more frequently than necessary, or instead of calling auth/renewAccessToken.Whether this is by mistake or not, you should request a single token per instance of API-powered application, and keep that token alive as long as possible.

Request

This endpoint expects an object.
namestringRequired<=64 characters
passwordstringRequired<=512 characters
hibpCheckbooleanOptional
appIdstringOptional<=64 characters
appVersionstringOptional<=64 characters
deviceIdstringOptional<=64 characters
cidstringOptional<=64 characters
secstringOptional<=8192 characters

Response

AccessTokenResponse
errorTextstringOptional<=8192 characters

Non-empty if the request failed

hibpHintenumOptional
EmailAndPasswordCompromised, PasswordCompromised
Allowed values:
accessTokenstringOptional<=8192 characters
expirationTimedatetimeOptional
passwordExpirationTimedatetimeOptional
userStatusenumOptional
Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail
Allowed values:
userIdlongOptional
namestringOptional<=64 characters
hasLivebooleanOptional
hasSimPlusbooleanOptional
showKIDsbooleanOptional