Renew a Tradovate API Token Before Expiry
A Tradovate access token only lasts 90 minutes. Here's how to renew it on a schedule so your session, and your automated orders, never actually lapse.
A Tradovate access token doesn't last your whole trading day. It's good for 90 minutes from the moment you log in, and once that window closes, every authenticated call comes back as a 401. If a bot is holding a position when that happens, it can't send a stop, a target, or a flatten until it re-authenticates. Not a great place to be.
The fix is boring in the best way: renew the token while it's still alive, on a schedule, so the session never actually lapses. You call one endpoint, swap in the fresh token, and carry on. Here's the full routine.
Why Renew Instead of Just Logging In Again
You could catch the 401 and call the login endpoint (/auth/accessTokenRequest) a second time. Don't make that your default. A fresh login opens a brand-new session, and Tradovate caps how many sessions you can hold at once and how often you can ask for tokens. Lean on new logins and you'll eventually trip a rate limit or a time penalty. Renewing keeps the same session going, so you sidestep both. Treat a full re-login as the emergency exit, not the routine.
| Renew /auth/renewAccessToken | New login /auth/accessTokenRequest | |
|---|---|---|
| Session | Keeps your current session | Starts a new session |
| Credentials | Not needed, uses your current token | Full username and password |
| When to use | Every cycle, before expiry | Only after the token has fully expired |
| Risk | Minimal | Can hit session or rate limits |
Before You Start
- API Access turned on for your account and a working access token.
- The
accessTokenandexpirationTimefrom your most recent login response. - Anything that can run a timer, a cron job, a
setInterval, a background thread. The language doesn't matter.
Renew the Token: Step-by-Step
Save the expirationTime from Your Login Response
When you authenticate, the JSON that comes back carries more than the token. Two fields matter here: accessToken, which you send on every request, and expirationTime, an ISO timestamp for when that token dies. Store both. The expirationTime is your countdown clock, everything else keys off it.
Check the Clock Every Couple of Minutes
Don't sleep for a flat 75 minutes and hope. Run a light check on a short interval, every two minutes is plenty, that compares the current time against your stored expirationTime. When the gap drops under about 15 minutes, it's time to renew. Checking on an interval also means a paused or restarted process re-evaluates against the real clock instead of a stale countdown.
Call the Renew Endpoint While the Token Is Still Valid
Hit /auth/renewAccessToken with your current, still-valid access token in the Authorization: Bearer header. No username, no password, no re-login, the endpoint just extends the session you already have. The one hard rule: the token you send has to still be valid. Renew after it's already expired and the call fails, which drops you back to a full login.
Swap in the New Token and Reset Your Clock
The renew response hands you a fresh accessToken and a new expirationTime. Overwrite your stored values with both, then let your interval keep watching the new timestamp. Do this every cycle and a single session can run all day, or all week, without a gap. Miss it, and you're re-authenticating under pressure.
POST /auth/renewAccessTokenAuthorization: Bearer <accessToken>
If the Token Already Expired
It happens. A process gets paused, a machine sleeps, the renew call slips past the deadline. When that's the case, renewing won't save you, the endpoint needs a token that's still alive. Run a full login again to get a new token and start a fresh session, then go straight back into the renew loop so it doesn't repeat. If you keep seeing 401s and aren't sure whether it's expiry or something else, the 401 Unauthorized (expired token) fix breaks down the usual causes.
Once your session stays alive, the piece that actually moves size is order routing, see how to place orders through the Tradovate API.
Automate This with PickMyTrade
Rather not write and babysit a refresh loop at all? PickMyTrade keeps the session alive for you, so your TradingView alerts route straight through to your account without you managing tokens by hand.
Skip the Token-Refresh Loop
Rather not write and babysit a refresh loop at all? PickMyTrade keeps the session alive for you, so your TradingView alerts route straight through without you managing tokens by hand.
Start Your Free 5-Day TrialThis guide is for educational and informational purposes only and is not financial, investment, or trading advice. Trading futures and other leveraged products carries a substantial risk of loss and is not suitable for every investor. PickMyTrade is an independent third-party automation platform and is not affiliated with, endorsed by, or sponsored by Tradovate, Inc. "Tradovate" and all related names, logos, and trademarks are the property of their respective owners. Platform features and steps change over time, so always confirm the current process in the official Tradovate platform and documentation before acting.