tastytradeDeveloper Docs
Legacy ↗

Quickstart

Get from nothing to your first authenticated call — and a safe sandbox order — in a few minutes. Use sandbox (https://api.cert.tastyworks.com) until you've verified your flow; production is https://api.tastyworks.com.

1. Get credentials

You must have an OAuth client registered with tastytrade to use the API. You'll need your client ID, client secret, and a refresh token for that client — see OAuth2 for how tokens work. Sandbox and production credentials are separate — don't mix environments (check which base URL you're hitting).

2. Mint a 15-minute access token

Exchange your refresh token for a short-lived access token via POST /oauth/token, sending grant_type, refresh_token, and client_secret in a JSON body (client_id is optional — if sent, it must match your client). See the OAuth2 guide for the full token flow:

curl -X POST 'https://api.cert.tastyworks.com/oauth/token' \
  -H 'User-Agent: my-app/1.0' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "YOUR_REFRESH_TOKEN",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

The response contains your access token. It's valid for 15 minutes — refresh when it expires (you can't extend one).

Always send a User-Agent in the form <product>/<version> (e.g. my-app/1.0). Requests without one are rejected with a 401.

3. Make your first call

Send the token as a Bearer header on every request. List your accounts:

curl 'https://api.cert.tastyworks.com/customers/me/accounts' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'User-Agent: my-app/1.0'

Then fetch balances for an account:

curl 'https://api.cert.tastyworks.com/accounts/{account_number}/balances' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'User-Agent: my-app/1.0'

4. Place an order — safely

Order placement is money-moving, and the API does not deduplicate retried submissions. The golden path is dry-run first, then submit with a unique external-identifier you can check for before any retry:

  1. Dry-run the order and confirm it returns no errors (check buying-power and fees).
  2. Submit the real order including a unique external-identifier.
  3. If the submit response is uncertain (timeout/5xx), list your orders (GET /accounts/{account_number}/orders or /orders/live) and check for your identifier before resubmitting — see Idempotency & retries.

See the Orders reference for the order JSON, and Rate limits & backoff for retry behavior.

5. Next steps