Register an OAuth App in Tradovate
Learn to register an OAuth app so third-party tools can securely connect to your futures trading account, with redirect URI and permission setup.
If you're building a tool that other traders will connect to their Tradovate accounts, you don't want to ask each of them for a username and password. That's the whole point of OAuth. Registering an OAuth app gives your integration a client ID and a client secret, and it lets your users grant access through a proper login screen instead of handing over raw credentials. Here's how to set one up from inside your own account.
Quick gut check before you start: if you're only automating your own account, you probably don't need OAuth at all. A plain API key with the username and password auth flow is simpler and does the job. OAuth earns its keep when third parties log in through your app.
What You'll Need First
- An active Tradovate account that has API access available on it.
- The API terms signed (a quick one-time step, covered below).
- A redirect URI, which is the callback URL your app listens on after a user logs in.
One caveat on prop-firm and evaluation accounts: API and OAuth availability varies by firm and account type, so check your firm's current rules before you count on it.
Register an OAuth App in Tradovate: Step-by-Step
Sign the API Terms
Before the OAuth options appear, Tradovate asks you to complete a self-attestation and sign the digital agreement covering its API terms and conditions. It's a one-time thing. Read it, accept it, and the developer options open up.
Open API Access and Choose OAuth Registration
Open Application Settings, then go to the API Access tab. You'll see the API options there. Pick OAuth Registration to start a new app. This is the same settings area you'd use to generate a standard API key, so if you've been there before it'll look familiar.
Fill in the App Details
The registration form asks for two required fields: App Title, the name users see on the consent screen when they authorize your app, and Redirect URI, where Tradovate sends the user back after they log in. This has to match, character for character, the redirect URI your app sends in the authorization request later. A trailing slash or a wrong port is enough to break the flow. You can also add a privacy policy link, a terms and conditions link, and upload a logo. Those are optional, but they make the consent screen look legitimate, which matters if strangers are trusting your app with account access.
Set the Permissions
Lower down on the form you choose the permissions that users will grant when they authorize through your app. Keep this tight. Ask only for what your integration actually uses. Narrow scopes are easier to trust and easier to reason about if something ever goes wrong.
Generate and Store Your Keys
When the form looks right, click Generate. Tradovate shows you the key one time only. Copy the client ID and secret immediately and put them somewhere safe, like a secrets manager or a server-side environment file. Never commit the secret to a public repository. If you lose it, you'll be registering again from scratch.
Putting the Credentials to Work
Once you've got the client ID and secret, the flow is a standard OAuth authorization code exchange. Send the user to the authorization URL, catch the single-use code on your redirect URI, then swap that code for an access token server-side.
Authorization URL:https://trader.tradovate.com/oauthwithresponse_type=code,client_id, andredirect_uriToken exchange URL:https://live.tradovateapi.com/auth/oauthtokenToken exchange body:grant_type=authorization_code,client_id,client_secret,redirect_uri,code
The redirect URI in the token exchange must match the one from the authorization request, which must match what you registered in Step 3. Access tokens expire, so build in a refresh routine rather than re-authorizing users constantly.
A Couple of Things That Trip People Up
Redirect URI mismatches are the number-one reason a fresh OAuth app won't complete the handshake, so lock that down first. The other one is the one-time key: people breeze past the Generate screen, lose the secret, and have to redo everything. Treat that screen like it's the only time you'll ever see it, because it is.
Automate This with PickMyTrade
Want the automation without building an OAuth app yourself? PickMyTrade connects TradingView to Tradovate for you, so you can route alerts to your account without writing a line of OAuth code.
Skip Building Your Own OAuth App
Let PickMyTrade connect TradingView to Tradovate for you, no OAuth code required.
Start Your Free 5-Day TrialThis guide is for educational and informational purposes only and is not financial, investment, or trading advice. Trading futures and other leveraged products carries a substantial risk of loss and is not suitable for every investor. PickMyTrade is an independent third-party automation platform and is not affiliated with, endorsed by, or sponsored by Tradovate, Inc. "Tradovate" and all related names, logos, and trademarks are the property of their respective owners. Platform features and steps change over time, so always confirm the current process in the official Tradovate platform and documentation before acting.