Exchange an OAuth authorization code for an access token.

Available to: Anyone with valid OAuth client credentials (no access token required)

Environments: Demo, Live

Rate Limit: 10 requests per hour, 30-second back-off, counts failed requests only

The final step of the OAuth authorization-code flow. After a user approves your application and you receive a single-use authorization code at your redirect URI, exchange that code here for an access token.

Send a form-encoded request with grant_type set to authorization_code, the client_id and client_secret issued to your application by NinjaTrader, the same redirect_uri you used to start the flow, and the code you received. On success, the response contains an access_token and expires_in (its lifetime in seconds); send the token with the Bearer scheme on subsequent requests.

[Source Content Needed: how a developer requests OAuth client credentials from NinjaTrader.]

<Note> Other grant types (such as `client_credentials` and `jwt-bearer`) are used for server-to-server and Connect integrations and are documented in the Connect docs, not here. </Note>

Common Failure Scenarios

• The authorization code has expired or was already used — codes are single-use.
• The redirect_uri does not match the one used to obtain the code.
• The client_id or client_secret is missing or incorrect.

On failure, the response omits access_token and instead returns the error and error_description fields (OAuth 2.0 standard), rather than an errorText field.

Error Messages