# API access is unclear

**URL:** <https://community.tradovate.com/t/api-access-is-unclear/10174>\
**Category:** API Developers\
**Created:** [September 3, 2024, 6:11pm UTC](https://community.tradovate.com/t/api-access-is-unclear/10174 "2024-09-03T18:11:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dylan\_Clark](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@Dylan\_Clark](https://community.tradovate.com/u/Dylan_Clark)\
**Post date:** [September 3, 2024, 6:11pm UTC](https://community.tradovate.com/t/api-access-is-unclear/10174/1 "2024-09-03T18:11:07Z")

</div>

Hi,

I am developing a REST client that will listen to market data, based on conditions trigger a new order etc, standard stuff.

Setting up seems overly complex.

I have gone through the step “Settings → Generate API key” and have saved my “secret” and “cid” (as generated).

Now when I try issue the curl command ( as outlined here [Tradovate API](https://api.tradovate.com/#tag/Access/Get-An-Access-Token-Using-Client-Credentials) ) , I am replacing the password field with the “secret” from above and the cid as from above, also my tradovate “Google:1234…1234” , username I use to login to tradovate web login.

cmd:\> curl -X POST [https://demo.tradovateapi.com/v1/auth/accesstokenrequest](https://demo.tradovateapi.com/v1/auth/accesstokenrequest)  
-H “Content-Type: application/json”  
-H “Accept: application/json”  
-d “{  
"name": " **your credentials here**",  
"password": " **your credentials here**",  
"appId": "Sample App",  
"appVersion": "1.0",  
"cid": 8,  
"deviceId": "123e4567-e89b-12d3-a456-426614174000",  
"sec": "f03741b6-f634-48d6-9308-c8fb871150c2"  
}”  
It gives me an error;

{“errorText”:“Incorrect username or password. Please try again.”}

Again, all I want to do is have the right credentials so I can do market data subscriptions and place/cancel/modify orders. Spefifically websockets for market data and REST API for Orders etc.

Can somebody please assist. This seems overly vague, should be real simple (do it on binance all the time).

Thanks much and have a nice day.

---

<div class="post-metadata">

**Author:** ![Gary\_Lynn](https://avatars.discourse-cdn.com/v4/letter/g/db5fbb/32.png) [@Gary\_Lynn](https://community.tradovate.com/u/Gary_Lynn)\
**Post date:** [September 21, 2024, 7:30pm UTC](https://community.tradovate.com/t/api-access-is-unclear/10174/2 "2024-09-21T19:30:57Z")

</div>

I am in the EXACT same place. Followed the exact same steps and got the exact same error. @Dylan_Clark were you able to resolve the issue, or did you give up?

---

<div class="post-metadata">

**Author:** ![Gary\_Lynn](https://avatars.discourse-cdn.com/v4/letter/g/db5fbb/32.png) [@Gary\_Lynn](https://community.tradovate.com/u/Gary_Lynn)\
**Post date:** [September 21, 2024, 7:40pm UTC](https://community.tradovate.com/t/api-access-is-unclear/10174/3 "2024-09-21T19:40:27Z")

</div>

Resolved the problem myself thanks to this post:

> [@API password?](https://community.tradovate.com/t/api-password/5161/2):
>
> The dedicated password is to hide your real password. So if your key ever became compromised, you could just delete the key and your personal data would remain secure. When you ask for an access token from the API you’ll need to provide the dedicated password instead of your user password for the “password” field.

Once I set the password for the API key and used that instead it worked fine.

---

<div class="post-metadata">

**Author:** ![Dylan\_Clark](https://avatars.discourse-cdn.com/v4/letter/d/a587f6/32.png) [@Dylan\_Clark](https://community.tradovate.com/u/Dylan_Clark)\
**Post date:** [September 30, 2024, 5:30am UTC](https://community.tradovate.com/t/api-access-is-unclear/10174/5 "2024-09-30T05:30:04Z")

</div>

Hi,

Yes I got it going. I use CURL C++ lib to get accessToken and marketAccessToken.

If its any help to you, here’s the function;

> //C++  
> size\_t WriteCallback(void\* contents, size\_t size, size\_t nmemb, std::string\* s) {  
> s-\>append(static\_cast\<char\*\>(contents), size \* nmemb);  
> std::cout \<\< "Received: " \<\< \*s \<\< std::endl;  
> auto tokens = extractMdAccessToken(\*s);  
> std::cout \<\< "Access Token: " \<\< tokens.first \<\< std::endl\<\< std::endl  
> \<\< "marketAccessToken: " \<\< tokens.second \<\< std::endl \<\< std::endl;
> 
> return size \* nmemb;  
> }
> 
> void authenticate(const std::string& username, const std::string& password, const std::string& appId, const std::string& appVersion, const std::string& deviceId, const std::string& cid, const std::string& secret)  
> {  
> CURL\* curl = curl\_easy\_init();  
> if (curl)  
> {  
> curl\_easy\_setopt(curl, CURLOPT\_URL, “[https://demo.tradovateapi.com/v1/auth/accesstokenrequest](https://demo.tradovateapi.com/v1/auth/accesstokenrequest)”);
> 
> ```
> // Create the JSON payload with the authentication credentials
> json auth_data = {
> {"name", username},
> {"password", password},
> {"appId", appId},
> {"appVersion", appVersion},
> {"deviceId", deviceId},
> {"cid", std::stoi(cid)},
> {"sec", secret}
> };
> 
> std::string json_data = auth_data.dump();
> 
> curl_easy_setopt(curl, CURLOPT_POSTFIELDS, json_data.c_str());
> 
> struct curl_slist* headers = NULL;
> headers = curl_slist_append(headers, "Content-Type: application/json");
> headers = curl_slist_append(headers, "Accept: application/json");
> curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
> 
> std::string response_string;
> curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, WriteCallback);
> curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response_string);
> 
> CURLcode res = curl_easy_perform(curl);
> if (res != CURLE_OK) {
> std::cerr << "curl_easy_perform() failed: " << curl_easy_strerror(res) << std::endl;
> } else {
> auto json_response = json::parse(response_string);
> accessToken = json_response["accessToken"];
> std::cout << "Access Token: " << accessToken << std::endl;
> }
> 
> curl_easy_cleanup(curl);
> curl_slist_free_all(headers);
> 
> ```
> 
> }  
> };