OAuth Integration

If your application acts on behalf of other users, use OAuth so each user authenticates with NinjaTrader directly instead of handing their credentials to your app. This page covers the authorization-code flow: the user approves your app, you receive a single-use code, and you exchange that code for an access token.

Prerequisites

• A client_id and client_secret issued by NinjaTrader for your application.
• A redirect URI you control, registered with your credentials. NinjaTrader returns the user to this URI with the authorization code after they authenticate.

Keep your client_secret out of public access — store it in an environment variable or secret manager, not in client-side code or a public repository.

The Flow

OAuth authentication is a three-step process:

1. Redirect the user to the authorize URL.
2. Receive a single-use code at your redirect URI.
3. Exchange the code for an access token.

Step 1 — Redirect to the Authorize URL

Send the user to the authorize endpoint with response_type=code, your client_id, and your redirect_uri:

1
const AUTH_URL = 'https://trader.tradovate.com/oauth'
2
3
const authUrl =
4
    AUTH_URL +
5
    '?response_type=code' +
6
    `&client_id=${encodeURIComponent(CLIENT_ID)}` +
7
    `&redirect_uri=${encodeURIComponent(REDIRECT_URI)}`
8
9
// e.g. in Express, redirect the user's browser there:
10
app.get('/auth', (_, res) => res.redirect(authUrl))

The user sees the NinjaTrader login screen and approves your application.

Step 2 — Receive the Code

After the user authenticates, NinjaTrader redirects to your redirect_uri with a single-use code in the query string. Extract it:

1
app.get('/oauth/tradovate/callback', async (req, res) => {
2
    if (req.query.code) {
3
        const code = req.query.code
4
        // exchange the code for a token (Step 3)
5
    }
6
})

Step 3 — Exchange the Code for an Access Token

Send a form-encoded POST to the token endpoint with grant_type=authorization_code and the same redirect_uri you used in Step 1:

1
const EXCHANGE_URL = 'https://live.tradovateapi.com/auth/oauthtoken'
2
3
const form = {
4
    grant_type: 'authorization_code',
5
    client_id: CLIENT_ID,
6
    client_secret: CLIENT_SECRET,
7
    redirect_uri: REDIRECT_URI,
8
    code: req.query.code
9
}
10
11
const response = await fetch(EXCHANGE_URL, {
12
    method: 'POST',
13
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
14
    body: new URLSearchParams(form)
15
})
16
17
const data = await response.json()
18
// success: { access_token, expires_in, ... }
19
// failure: { error, error_description }

A successful response includes an access_token and expires_in (the token’s lifetime in seconds). On failure, the response includes error and error_description.

Using the Token

Send the access token on each request using the Bearer scheme — for example, to read the authenticated user with me:

1
const me = await fetch('https://live.tradovateapi.com/v1/auth/me', {
2
    headers: { 'Authorization': `Bearer ${accessToken}` }
3
}).then(res => res.json())

The token is valid for the expires_in window. When it expires, run the flow again to obtain a new one. For session limits and token renewal on the credential flow, see Authentication & Access.