Access tokens are the keys used for API access. These tokens should be protected like passwords! You can obtain an access token by exchanging an authorization code. This call is authenticated using Basic Authentication implemented in HTTP specification. Your application client ID will serve as your username and the client secret the password.
Client Id: kaGA65sIl79IdXxr3lnGs7J2C9CywQtJ
Client secret: ueeKzJOEh0fh6Dh8
The Authorization header is constructed as follows:
For example, if the user agent uses ‘kaGA65sIl79IdXxr3lnGs7J2C9CywQtJ’ as the client Id and ‘ueeKzJOEh0fh6Dh8’ as the client secret then the header is formed as follows:
1. kaGA65sIl79IdXxr3lnGs7J2C9CywQtJ:ueeKzJOEh0fh6Dh8
2. a2FHQTY1c0lsNzlJZFh4cjNsbkdzN0oyQzlDeXdRdEo6dWVlS3pKT0VoMGZoNkRoOA==
3. Authorization: Basic a2FHQTY1c0lsNzlJZFh4cjNsbkdzN0oyQzlDeXdRdEo6dWVlS3pKT0VoMGZoNkRoOA==
Unlike other requests to the Tradier API, this request only returns JSON due to the OAuth 2.0 specification and for compatibility with most OAuth clients.
Due to the OAuth specification, this API endpoint uses HTTP Basic Authentication. You can learn more about HTTP Basic Authentication on Wikipedia or directly reference the specification.
Header | Required | Values/Example | Default | |
---|---|---|---|---|
Content-Type | Required | application/x-www-form-urlencoded | ||
Authorization | Required | Basic lhQOWo0RzJUOWc6Z== | ||
Basic HTTP Authentication. Username: Application client Id, Password: Application client secret |
Parameter | Type | Param Type | Required | Values/Example | Default |
---|---|---|---|---|---|
grant_type | Body | String | Required | authorization_code | |
Value MUST be set to "authorization_code". | |||||
code | Body | String | Required | PRpnf1o7 | |
The authorization code from the authorization step. |