Trade It Documentation

Appearance

Authentication ​

Authentication is the first step in the deep integration flow. Once users authorize your platform with Trade It, your server can request session URLs for connect and trade modals.

Before implementing OAuth, register your client in Trade It:

  1. Sign in at tradeit.app.
  2. Choose Organization on first login, or use Register a Client from your dashboard later.
  3. Complete partner setup and billing in the partner portal.
  4. Save the client_id and one-time client_secret shown after provisioning.

If you have questions or want to discuss your use case, contact us.

OAuth Discovery ​

Trade It publishes standard OAuth authorization-server metadata at:

text
https://tradeit.app/.well-known/oauth-authorization-server

Use the endpoints from that document rather than hardcoding them. The current authorization and token endpoints are:

text
Authorization: https://auth.tradeit.app/auth/v1/authorize
Token:         https://auth.tradeit.app/auth/v1/token

Trade It supports the authorization-code and refresh-token grants, PKCE with S256, and confidential-client authentication with either client_secret_basic or client_secret_post.

How OAuth Works ​

  1. User clicks a "Connect Trade It" action in your app.
  2. User authenticates with Trade It and grants permission.
  3. Trade It redirects to your callback URL.
  4. Your server exchanges the authorization code for tokens.
  5. Your server stores Trade It access/refresh tokens for that user.

Once tokens are stored, you can launch embedded connect and trade flows.

OAuth flow diagram between your client app, your server, and Trade It

What You Need to Implement ​

  • A client-side "Connect Trade It" entry point.
  • A callback route on your platform.
  • A server-side code exchange using your client_id and client_secret.
  • Secure per-user storage for Trade It access and refresh tokens.

For SDK integrations, request the scopes assigned to your partner client. Connect sessions require brokerage write access; trade sessions require asset read, brokerage read, and trade write access. The metadata document is the source of truth for supported scope names.

Refresh the user's access token server-side when needed. Never put an access token, refresh token, or client secret in browser storage or client-side source.

Notes ​

  • Keep client_secret on your server only.
  • Never exchange OAuth codes from client-side code.
  • Session URL calls should always be server-side and use the user's Trade It token.
  • Request a fresh session URL immediately before opening a modal; session URLs expire after 30 minutes.