O Auth Token
Exchange an OAuth authorization code for an access token.
Available to: Anyone with valid OAuth client credentials (no access token required)
Environments: Demo, Live
Rate Limit: 10 requests per hour, 30-second back-off, counts failed requests only
The final step of the OAuth authorization-code flow. After a user approves your application and you receive a single-use authorization code at your redirect URI, exchange that code here for an access token.
Send a form-encoded request with grant_type set to authorization_code, the client_id and client_secret issued to your application by NinjaTrader, the same redirect_uri you used to start the flow, and the code you received. On success, the response contains an access_token and expires_in (its lifetime in seconds); send the token with the Bearer scheme on subsequent requests.
[Source Content Needed: how a developer requests OAuth client credentials from NinjaTrader.]
Other grant types (such as client_credentials and jwt-bearer) are used for server-to-server and Connect integrations and are documented in the Connect docs, not here.
Common Failure Scenarios
- The authorization
codehas expired or was already used — codes are single-use. - The
redirect_uridoes not match the one used to obtain the code. - The
client_idorclient_secretis missing or incorrect.
On failure, the response omits access_token and instead returns the error and error_description fields (OAuth 2.0 standard), rather than an errorText field.
Error Messages