Tradovate OAuth vs API-Key Authentication
Compare the direct access-token and OAuth login flows for the futures API, see how each works, and pick the right authentication method for your bot.
There are two ways to get code talking to the Tradovate API, and people mix them up all the time. One is the direct access-token request, where you use an API key you generated for your own account. The other is OAuth, where a trader logs in on Tradovate's own page and hands your app a token without ever giving you their password. Choose the wrong one and you'll either sit on credentials you shouldn't be holding, or hit a wall the moment you try to connect somebody else's account. Here's how each flow actually works and when to reach for it.
Both methods end in the same place: a short-lived bearer token you attach to every request as Authorization: Bearer {token}. The difference is entirely in how you get that token and whose account it's for.
| Direct access-token (API key) | OAuth | |
|---|---|---|
| Best for | Automating your own account | An app that other traders log into |
| Credentials you hold | Your own username, password, and API key (cid + secret) | A client ID and secret from Tradovate, never the user's password |
| Where the user logs in | Inside your own code | On Tradovate's hosted login page |
| How you get set up | Generate the key yourself in Settings | Request client credentials from Tradovate |
| What comes back | Bearer access token | Bearer access token |
The Direct Access-Token Method
This is the simpler path, and it's the right one when the account you're automating belongs to you. You create an API key inside the platform once, then trade a short POST for a token whenever you need one.
Enable API Access and Generate Your Key
Open your account Settings and find the API Access add-on. It carries a small recurring fee, and key generation is gated behind a funded live account above a minimum balance. Those numbers change, so confirm the current price and threshold in your own account. Once it's active, open the API Access tab, generate a new key, give it a nickname, allow full access, and create it. Copy the CID and secret immediately. Tradovate shows the secret exactly once and never displays it again, so store it somewhere safe and keep it out of public repositories.
Request a Bearer Token Directly
Send a POST to /auth/accesstokenrequest with your name, password, appId, appVersion, cid, sec, and a stable deviceId. Hit the demo host while you're testing and the live host once you're placing real orders. The response hands back an accessToken for trading, a separate mdAccessToken for market data, and an expiration time.
That token is short-lived. The response tells you exactly when it expires, and you renew it by calling /auth/renewAccessToken with the still-valid token a little before that time, not by re-sending your password on a loop, which is how people end up locked out with a 401.
The OAuth Method
Reach for OAuth the moment you're acting on behalf of anyone but yourself, a dashboard, a copy-trade tool, any product real traders sign into. They log in on Tradovate's page, so their password never touches your servers. You get a token scoped to their account and nothing more.
Get OAuth Client Credentials
Unlike an API key, you can't self-serve these. Contact Tradovate, request a client ID and client secret, and register the exact redirect URI your app will use, for example https://yourapp.com/oauth/callback. The redirect URI has to match later, character for character.
Send the User to the Authorization Page
Redirect the trader to Tradovate's authorization URL, https://trader.tradovate.com/oauth, with response_type=code, your URL-encoded client_id, and your URL-encoded redirect_uri. They sign in with their own Tradovate credentials and approve access. Tradovate then bounces them back to your redirect URI with a single-use code tacked onto the query string.
Exchange the Code for a Token
Do this from your server, never from the browser, the client secret has to stay private. POST to the OAuth token endpoint, https://live.tradovateapi.com/auth/oauthtoken, with grant_type=authorization_code, the code you just received, your client_id, client_secret, and the matching redirect_uri. Back comes an access_token and an expires_in. From here it's identical to the direct flow: attach the bearer token to every request and refresh it before it lapses.
Which One Should You Use?
If you're automating only your own account, use the direct access-token flow. It's fewer moving parts, you control the key, and there's no third party to coordinate with. If you're building anything other traders connect to, use OAuth every single time. Handling someone else's password yourself is a liability you don't want, and the OAuth flow exists precisely so you never have to.
Two things to check before you build on a funded or evaluation account: whether direct API automation is allowed depends on your firm, some permit it, some don't, and real-time API market data can carry a separate exchange fee. Confirm both against your firm's current rules and your own account rather than assuming.
Automate This with PickMyTrade
Rather not babysit tokens, renewals, and redirect URIs at all? PickMyTrade connects your TradingView alerts straight to Tradovate without you writing a line of authentication code.
Skip the Authentication Code
Let PickMyTrade connect your TradingView alerts straight to Tradovate, no tokens, renewals, or redirect URIs to manage.
Start Your Free 5-Day TrialThis guide is for educational and informational purposes only and is not financial, investment, or trading advice. Trading futures and other leveraged products carries a substantial risk of loss and is not suitable for every investor. PickMyTrade is an independent third-party automation platform and is not affiliated with, endorsed by, or sponsored by Tradovate, Inc. "Tradovate" and all related names, logos, and trademarks are the property of their respective owners. Platform features and steps change over time, so always confirm the current process in the official Tradovate platform and documentation before acting.