> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.ninjatrader.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.ninjatrader.com/_mcp/server. # Access Token Request POST https://demo.tradovateapi.com/v1/auth/accesstokenrequest Content-Type: application/json ### Request an access token using your credentials and API Key. **Available to:** Anyone with valid API credentials (no access token required) **Environments:** Demo, Live **[Rate Limit](/api/authentication#request-rate-limits-and-time-penalties):** 5 requests per hour, 15-second back-off, counts failed requests only Exchange your credentials for an access token, then send that token with the `Bearer` scheme on subsequent requests. Provide your `name` and `password`, your application identifiers (`appId`, `appVersion`, `deviceId`), and your API Key (`cid` and `sec`). On success, the response includes an `accessToken` and its `expirationTime`, plus an `mdAccessToken` for market data requests. A successful request starts a tracked session. Mind the token lifetime and session limits: - An access token lasts about 90 minutes — the exact moment is in `expirationTime`. Extend it by calling [`renewAccessToken`](/api/rest-api-endpoints/authentication/renew-access-token) about 15 minutes before it expires, rather than requesting a new token. - You're limited to two concurrent sessions per user; a third closes the oldest. Use a dedicated API user and centralize token issuance, sharing one token across dependent services. See [Authentication & Access](/api/authentication) for the full walkthrough and session guidance. **Common Failure Scenarios** - The `name`/`password` or API Key (`cid`/`sec`) is incorrect. - Too many failed attempts trigger a time penalty: the response carries `p-ticket` and `p-time`, and you can retry after `p-time` seconds. When `p-captcha` is `true`, retry from a third-party application is blocked for about an hour. **Error Messages** | `errorText` | Trigger | |-------------|---------| | Non-empty `errorText` | The request failed; the field describes the reason (for example, invalid credentials). | Reference: https://docs.ninjatrader.com/api/rest-api-endpoints/authentication/access-token-request ## OpenAPI Specification ```yaml openapi: 3.1.0 info: title: public version: 1.0.0 paths: /auth/accesstokenrequest: post: operationId: accessTokenRequest summary: Access Token Request description: >- ### Request an access token using your credentials and API Key. **Available to:** Anyone with valid API credentials (no access token required) **Environments:** Demo, Live **[Rate Limit](/api/authentication#request-rate-limits-and-time-penalties):** 5 requests per hour, 15-second back-off, counts failed requests only Exchange your credentials for an access token, then send that token with the `Bearer` scheme on subsequent requests. Provide your `name` and `password`, your application identifiers (`appId`, `appVersion`, `deviceId`), and your API Key (`cid` and `sec`). On success, the response includes an `accessToken` and its `expirationTime`, plus an `mdAccessToken` for market data requests. A successful request starts a tracked session. Mind the token lifetime and session limits: - An access token lasts about 90 minutes — the exact moment is in `expirationTime`. Extend it by calling [`renewAccessToken`](/api/rest-api-endpoints/authentication/renew-access-token) about 15 minutes before it expires, rather than requesting a new token. - You're limited to two concurrent sessions per user; a third closes the oldest. Use a dedicated API user and centralize token issuance, sharing one token across dependent services. See [Authentication & Access](/api/authentication) for the full walkthrough and session guidance. **Common Failure Scenarios** - The `name`/`password` or API Key (`cid`/`sec`) is incorrect. - Too many failed attempts trigger a time penalty: the response carries `p-ticket` and `p-time`, and you can retry after `p-time` seconds. When `p-captcha` is `true`, retry from a third-party application is blocked for about an hour. **Error Messages** | `errorText` | Trigger | |-------------|---------| | Non-empty `errorText` | The request failed; the field describes the reason (for example, invalid credentials). | tags: - Authentication responses: '200': description: AccessTokenResponse content: application/json: schema: $ref: '#/components/schemas/AccessTokenResponse' requestBody: content: application/json: schema: $ref: '#/components/schemas/AccessTokenRequest' servers: - url: https://demo.tradovateapi.com/v1 description: Demo - url: https://live.tradovateapi.com/v1 description: Live components: schemas: AccessTokenRequest: type: object properties: hibpCheck: type: boolean name: type: string password: type: string appId: type: string appVersion: type: string deviceId: type: string cid: type: string sec: type: string required: - name - password title: AccessTokenRequest AccessTokenResponseHibpHint: type: string enum: - EmailAndPasswordCompromised - PasswordCompromised description: EmailAndPasswordCompromised, PasswordCompromised title: AccessTokenResponseHibpHint AccessTokenResponseUserStatus: type: string enum: - Active - Closed - Initiated - TemporaryLocked - UnconfirmedEmail description: Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail title: AccessTokenResponseUserStatus AccessTokenResponse: type: object properties: errorText: type: string description: Non-empty if the request failed hibpHint: $ref: '#/components/schemas/AccessTokenResponseHibpHint' description: EmailAndPasswordCompromised, PasswordCompromised accessToken: type: string expirationTime: type: string format: date-time passwordExpirationTime: type: string format: date-time userStatus: $ref: '#/components/schemas/AccessTokenResponseUserStatus' description: Active, Closed, Initiated, TemporaryLocked, UnconfirmedEmail userId: type: integer format: int64 name: type: string hasLive: type: boolean hasSimPlus: type: boolean showKIDs: type: boolean title: AccessTokenResponse ``` ## Examples **Request** ```json { "name": "string", "password": "string" } ``` **Response** ```json { "errorText": "string", "hibpHint": "EmailAndPasswordCompromised", "accessToken": "string", "expirationTime": "2024-01-15T09:30:00Z", "passwordExpirationTime": "2024-01-15T09:30:00Z", "userStatus": "Active", "userId": 1, "name": "string", "hasLive": true, "hasSimPlus": true, "showKIDs": true } ``` **SDK Code** ```python import requests url = "https://demo.tradovateapi.com/v1/auth/accesstokenrequest" payload = { "name": "string", "password": "string" } headers = {"Content-Type": "application/json"} response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://demo.tradovateapi.com/v1/auth/accesstokenrequest'; const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"name":"string","password":"string"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://demo.tradovateapi.com/v1/auth/accesstokenrequest" payload := strings.NewReader("{\n \"name\": \"string\",\n \"password\": \"string\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://demo.tradovateapi.com/v1/auth/accesstokenrequest") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Content-Type"] = 'application/json' request.body = "{\n \"name\": \"string\",\n \"password\": \"string\"\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://demo.tradovateapi.com/v1/auth/accesstokenrequest") .header("Content-Type", "application/json") .body("{\n \"name\": \"string\",\n \"password\": \"string\"\n}") .asString(); ``` ```php request('POST', 'https://demo.tradovateapi.com/v1/auth/accesstokenrequest', [ 'body' => '{ "name": "string", "password": "string" }', 'headers' => [ 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://demo.tradovateapi.com/v1/auth/accesstokenrequest"); var request = new RestRequest(Method.POST); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"name\": \"string\",\n \"password\": \"string\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["Content-Type": "application/json"] let parameters = [ "name": "string", "password": "string" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://demo.tradovateapi.com/v1/auth/accesstokenrequest")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```