O Auth Token

### Exchange an OAuth authorization code for an access token. **Available to:** Anyone with valid OAuth client credentials (no access token required) **Environments:** Demo, Live **[Rate Limit](/api/authentication#request-rate-limits-and-time-penalties):** 10 requests per hour, 30-second back-off, counts failed requests only The final step of the [OAuth authorization-code flow](/api/oauth). After a user approves your application and you receive a single-use authorization `code` at your redirect URI, exchange that code here for an access token. Send a form-encoded request with `grant_type` set to `authorization_code`, the `client_id` and `client_secret` issued to your application by NinjaTrader, the same `redirect_uri` you used to start the flow, and the `code` you received. On success, the response contains an `access_token` and `expires_in` (its lifetime in seconds); send the token with the `Bearer` scheme on subsequent requests. [Source Content Needed: how a developer requests OAuth client credentials from NinjaTrader.] <Note> Other grant types (such as `client_credentials` and `jwt-bearer`) are used for server-to-server and Connect integrations and are documented in the Connect docs, not here. </Note> **Common Failure Scenarios** - The authorization `code` has expired or was already used — codes are single-use. - The `redirect_uri` does not match the one used to obtain the code. - The `client_id` or `client_secret` is missing or incorrect. On failure, the response omits `access_token` and instead returns the `error` and `error_description` fields (OAuth 2.0 standard), rather than an `errorText` field. **Error Messages** | `error` | Trigger | |---------|---------| | `invalid_grant` | The authorization code is expired, already used, or does not match the `redirect_uri`. | | `invalid_client` | The `client_id` or `client_secret` is missing or incorrect. |