FAQ
Answers to the questions we hear most often. For the full catalog of error codes and their meanings, see /reference/errors. New to the API? Start at /docs/get-started.
Why am I suddenly getting unconfirmed_user errors?
All users must confirm their email address within 3 days of signing up. This includes sandbox users.
To confirm your email address, request a confirmation email:
curl -X POST https://api.cert.tastyworks.com/confirmation \
-H "Content-Type: application/json" \
-d '{ "email": "you@example.com" }'Check your inbox for a link to confirm your email address. Once you have clicked the link and see a success message, you are good to go.
Why do I keep getting invalid_credentials errors?
This error occurs when your username or password is wrong during login. Be sure you are hitting the correct environment. There is a sandbox environment and a production environment, and each requires a separate set of credentials. If you hit production with your sandbox credentials (or vice versa), you will likely see invalid_credentials.
To diagnose which environment you are hitting, check the URL of your request:
| Environment | Base URL |
|---|---|
| Sandbox | https://api.cert.tastyworks.com |
| Production | https://api.tastyworks.com |
If needed, you can reset your production password at tastytrade.com.
Why am I getting a 401 when my credentials are valid?
tastytrade has specific requirements around the User-Agent header. The format must be <product>/<version> (for example, my-app/1.0.0). Without a valid User-Agent, you will get a 401 with an HTML response like this:
<html>
<head>
<title>401 Authorization Required</title>
</head>
<body>
<center>
<h1>401 Authorization Required</h1>
</center>
<hr>
<center>nginx</center>
</body>
</html>This nginx-style 401 (rather than a JSON error body) is the tell-tale sign that the User-Agent header is missing or malformed.
Why am I getting unauthorized errors?
This error occurs when you do not have a valid access token. OAuth access tokens last 15 minutes and must be sent in the Authorization header on every request. Generate a fresh token with POST /oauth/token and include it on each subsequent request:
GET /customers/me/accounts HTTP/1.1
Host: api.cert.tastyworks.com
User-Agent: my-app/1.0.0
Authorization: Bearer <access-token>When a token expires, you will start seeing 401s again — refresh it rather than reusing a stale one.
Why are my HTTP requests suddenly timing out?
tastytrade will block your IP address outright if we receive too many failed login attempts within a short period. We do this to protect users' accounts from being brute-forced.
The IP block typically lasts about 8 hours. During that time you cannot connect to any endpoint — requests simply time out. To request an early unblock, email api.support@tastytrade.com.
How do I reset my sandbox user password?
On the sandbox sign-in page, look for the "Reset it here" link under the sign-in button. Enter your email address and check your inbox for further instructions.
Can I delete my sandbox user?
No. If you no longer have access to the email account tied to it, contact api.support@tastytrade.com.
I can't access the sandbox environment (ENOTFOUND / Failed to resolve)
If you see errors like Failed to resolve or ENOTFOUND, make sure you are using the correct host. The sandbox URL is api.cert.tastyworks.com. For example, to fetch your accounts you would hit:
curl https://api.cert.tastyworks.com/customers/me/accounts \
-H "User-Agent: my-app/1.0.0" \
-H "Authorization: Bearer <access-token>"Do you have rate-limit or retry guidance?
Yes — see /docs/guides/rate-limits-and-backoff for handling 429s and 5xx responses with backoff.
How do I avoid placing a duplicate order?
Always dry-run an order first, then submit the live order with a unique external-identifier in the request body. The API does not de-duplicate retried submissions, and there is no idempotency-key header — if the outcome of a submission is uncertain (timeout or 5xx), check GET /accounts/{account_number}/orders (or /orders/live) for your external-identifier before resubmitting. See /docs/guides/idempotency-and-retries for the full pattern.
Where can I find sample code or the full API reference?
See the SDKs and tooling pages, including the MCP server, and browse the complete endpoint list at /reference.