Register an OAuth App in Tradovate

Learn to register an OAuth app so third-party tools can securely connect to your futures trading account, with redirect URI and permission setup.

Reviewed by the PickMyTrade Trading Systems Team Last updated July 8, 2026

· 6 min read

Tradovate API terms and self-attestation agreement screen

If you're building a tool that other traders will connect to their Tradovate accounts, you don't want to ask each of them for a username and password. That's the whole point of OAuth. Registering an OAuth app gives your integration a client ID and a client secret, and it lets your users grant access through a proper login screen instead of handing over raw credentials. Here's how to set one up from inside your own account.

Quick gut check before you start: if you're only automating your own account, you probably don't need OAuth at all. A plain API key with the username and password auth flow is simpler and does the job. OAuth earns its keep when third parties log in through your app.

What You'll Need First

An active Tradovate account that has API access available on it.
The API terms signed (a quick one-time step, covered below).
A redirect URI, which is the callback URL your app listens on after a user logs in.

One caveat on prop-firm and evaluation accounts: API and OAuth availability varies by firm and account type, so check your firm's current rules before you count on it.

Register an OAuth App in Tradovate: Step-by-Step

Sign the API Terms

Before the OAuth options appear, Tradovate asks you to complete a self-attestation and sign the digital agreement covering its API terms and conditions. It's a one-time thing. Read it, accept it, and the developer options open up.

Open API Access and Choose OAuth Registration

Open Application Settings, then go to the API Access tab. You'll see the API options there. Pick OAuth Registration to start a new app. This is the same settings area you'd use to generate a standard API key, so if you've been there before it'll look familiar.

Fill in the App Details

The registration form asks for two required fields: App Title, the name users see on the consent screen when they authorize your app, and Redirect URI, where Tradovate sends the user back after they log in. This has to match, character for character, the redirect URI your app sends in the authorization request later. A trailing slash or a wrong port is enough to break the flow. You can also add a privacy policy link, a terms and conditions link, and upload a logo. Those are optional, but they make the consent screen look legitimate, which matters if strangers are trusting your app with account access.

Set the Permissions

Lower down on the form you choose the permissions that users will grant when they authorize through your app. Keep this tight. Ask only for what your integration actually uses. Narrow scopes are easier to trust and easier to reason about if something ever goes wrong.

Generate and Store Your Keys

When the form looks right, click Generate. Tradovate shows you the key one time only. Copy the client ID and secret immediately and put them somewhere safe, like a secrets manager or a server-side environment file. Never commit the secret to a public repository. If you lose it, you'll be registering again from scratch.

Tradovate Application Settings showing the API Access tab and OAuth Registration option

Tradovate OAuth registration form with App Title and Redirect URI fields

Permissions section of the Tradovate OAuth app registration form

Tradovate OAuth Generate button and the one-time client ID and secret display

Putting the Credentials to Work

Once you've got the client ID and secret, the flow is a standard OAuth authorization code exchange. Send the user to the authorization URL, catch the single-use code on your redirect URI, then swap that code for an access token server-side.

Authorization URL: https://trader.tradovate.com/oauth with response_type=code, client_id, and redirect_uri

Token exchange URL: https://live.tradovateapi.com/auth/oauthtoken

Token exchange body: grant_type=authorization_code, client_id, client_secret, redirect_uri, code

The redirect URI in the token exchange must match the one from the authorization request, which must match what you registered in Step 3. Access tokens expire, so build in a refresh routine rather than re-authorizing users constantly.

A Couple of Things That Trip People Up

Redirect URI mismatches are the number-one reason a fresh OAuth app won't complete the handshake, so lock that down first. The other one is the one-time key: people breeze past the Generate screen, lose the secret, and have to redo everything. Treat that screen like it's the only time you'll ever see it, because it is.

Automate This with PickMyTrade

Want the automation without building an OAuth app yourself? PickMyTrade connects TradingView to Tradovate for you, so you can route alerts to your account without writing a line of OAuth code.

Skip Building Your Own OAuth App

Let PickMyTrade connect TradingView to Tradovate for you, no OAuth code required.

Start Your Free 5-Day Trial

This guide is for educational and informational purposes only and is not financial, investment, or trading advice. Trading futures and other leveraged products carries a substantial risk of loss and is not suitable for every investor. PickMyTrade is an independent third-party automation platform and is not affiliated with, endorsed by, or sponsored by Tradovate, Inc. "Tradovate" and all related names, logos, and trademarks are the property of their respective owners. Platform features and steps change over time, so always confirm the current process in the official Tradovate platform and documentation before acting.