Build a Tradovate Auto-Trading Bot With the API
A trading bot sounds complicated until you break it into parts. Here's how the pieces fit together end to end, from authenticating and streaming market data to placing orders, and the one flag that gets a lot of first bots rejected.
A trading bot sounds complicated until you break it into parts. Underneath, it's a loop: log in, watch prices, decide, send an order, repeat. Tradovate's official JavaScript examples lay out exactly that path, and you can follow the same shape in Python, C#, or whatever you're comfortable with. Here's how the pieces fit together end to end, and the one flag that gets a lot of first bots rejected.
What Does a Tradovate Trading Bot Actually Do?
At its core, a Tradovate bot authenticates once for an access token, holds a live connection to market data, runs your logic on every price update, and calls the order endpoint when your rules say to. The official example-api-js repo splits this into an Access track (REST auth and orders) and a WebSockets track (real-time data and trading). The AutoTrade example ties them into an event-driven engine where a strategy reacts to quotes, DOM, and chart events as they stream in.
Building the Bot Step by Step
Turn On API Access and Grab Your App Credentials
First you need the keys. Enable the API Access add-on on your account, then note the three values your code will authenticate with: appId (a name for your app), cid (client id), and sec (client secret). You'll pair those with your normal Tradovate username and password. Heads up: some prop firms restrict or ban direct API bots on their accounts, so confirm your firm allows it before you build against a funded account, rules vary by firm, so check your current agreement.
Authenticate and Get an Access Token
Nothing else works without a token. POST a credentials body to /auth/accessTokenRequest with your name, password, appId, appVersion, cid, sec, and a deviceId. The response hands back an accessToken you attach as Authorization: Bearer on every call after this. Tokens live about 90 minutes, so don't wait for a 401, call /auth/renewAccessToken roughly 15 minutes before expiry to keep the session warm. Include a stable deviceId; live trading enforces device approval more strictly than demo does.
Stream Live Market Data Over WebSocket
REST is fine for one-off calls, but a bot needs a constant feed, and that's what the WebSocket is for. Open a socket to the market-data host (md.tradovateapi.com), send your access token to authorize, then subscribe to what you care about, md/subscribeQuote for prices, or DOM and chart subscriptions for depth and bars. From here your code receives an event every time the market moves. Keep the heartbeat alive so the connection doesn't drop mid-session.
Turn Your Signal Into Orders With placeOrder
This is the brain. In the AutoTrade pattern, your strategy extends a base class and implements a next() function that works like a reducer: it takes the current state plus the incoming market event and returns updated state. That's where your indicator math and entry rules live. When the state says "go," build the order payload and send it to /order/placeOrder. That isAutomated field matters more than it looks. It must be true for any order a bot or algorithm fires, it's a CME compliance requirement, not a suggestion. Leave it off and you're inviting rejections. Pull accountId and accountSpec from /account/list, and always use the current front-month contract symbol.
Test on Demo, Then Handle Tokens and Rate Limits
Run the whole loop against the demo host (demo.tradovateapi.com/v1) until it behaves, wrong logic on the live host (live.tradovateapi.com/v1) costs real money. A few things trip up new bots: you're capped at 2 concurrent sessions, so a stray login knocks the first offline; hammering REST endpoints trips rate limits and a p-ticket time penalty you must wait out; and a lapsed token silently breaks everything. Log every response and only flip to live once demo runs clean for a full session.
{"name": "your_username","password": "your_password","appId": "MyTradingBot","appVersion": "1.0","cid": 1234,"sec": "YOUR_CLIENT_SECRET","deviceId": "a-stable-uuid"}
{"accountSpec": "YOUR_ACCOUNT_NAME","accountId": 123456,"action": "Buy","symbol": "MESU6","orderQty": 1,"orderType": "Market","isAutomated": true}
Skip the Plumbing With PickMyTrade
Building the whole stack yourself, token renewal, WebSocket heartbeats, the isAutomated flag, rate-limit backoff, is real work before you've placed a single strategic trade. If your signal already lives in TradingView, PickMyTrade routes those alerts straight into your Tradovate account with the orders formatted and compliance-flagged for you, no API code required.
Skip Building the Bot Yourself
Token renewal, WebSocket heartbeats, and rate-limit backoff are real work. Let PickMyTrade route your TradingView alerts to Tradovate instead.
Start Your Free 5-Day TrialFrequently Asked Questions
To build directly on the API, yes, you'll be writing auth calls, a WebSocket handler, and order logic. If you'd rather not, a bridge like PickMyTrade turns TradingView alerts into Tradovate orders without any programming.
The most common cause is a missing or false isAutomated flag on an automated order, which the exchange won't accept. After that, check for a wrong accountId/accountSpec, an expired token, or hitting the demo host with live credentials.
Yes. Point everything at the demo host and run your strategy on a simulated account first. Keep it there until the full loop, auth, data, orders, runs clean before touching the live environment.
This guide is for educational and informational purposes only and is not financial, investment, or trading advice. Trading futures and other leveraged products carries a substantial risk of loss and is not suitable for every investor. PickMyTrade is an independent third-party automation platform and is not affiliated with, endorsed by, or sponsored by Tradovate, Inc. "Tradovate" and all related names, logos, and trademarks are the property of their respective owners. Platform features and steps change over time, so always confirm the current process in the official Tradovate platform and documentation before acting.