# I can send OSO order in demo ,but Access denied in Replay

**URL:** <https://community.tradovate.com/t/i-can-send-oso-order-in-demo-but-access-denied-in-replay/4459>\
**Category:** API Developers\
**Created:** [April 16, 2022, 9:25am UTC](https://community.tradovate.com/t/i-can-send-oso-order-in-demo-but-access-denied-in-replay/4459 "2022-04-16T09:25:18Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![zhangdc007](https://sea1.discourse-cdn.com/flex015/user_avatar/community.tradovate.com/zhangdc007/32/1792_2.png) [@zhangdc007](https://community.tradovate.com/u/zhangdc007)\
**Post date:** [April 22, 2022, 9:28am UTC](https://community.tradovate.com/t/i-can-send-oso-order-in-demo-but-access-denied-in-replay/4459/16 "2022-04-22T09:28:56Z")

</div>

Thanks @beebee ,I only recevie the Email without any aprove link. does I need use the rule to general device Id: [UnderstandingDeviceId](https://github.com/tradovate/example-api-faq/blob/main/docs/UnderstandingDeviceId.md)  
the node code:

```auto
const crypto = require('crypto')

const myUID = crypto.createHash('sha256')
    .update(username)
    .update(password)
    .update(secret)
    .digest('hex')

```

it is SHA-256 hash in hex format (a 64 character string). The hash is based on some arbitrary, but non-changing fields - `username` , `password` , and some kind of app-specific `secret`  
and at last It say

```auto
you can use whatever fields you want as long as they don't change.

```

but I use Md5(username+password+apiSecret),I think it don’t change,and I can see my app in the trust device list ,and recevie the Email (with no any aprove link),but I try send order in Replay and live ,it is be Aceess deny too.  
so I confuse the rule of general the device Id ，May be the live and replay model will use a typical rule to general the deviceId to check my id is valid or not?mybat like:

```auto
byte[] bytes = SHA256(userName+password+apiSecre);
String hexString = hex(bytes);

```

but I found the String is like

```auto
33e321c0f7b5b570a76cb4c4417d6af0d7f7a9d8bf4da8f9a7ea391993617ca2

```

not similar the example ,like

```auto
d7afce-0496a0-8d7651-79f60-c6f3-8fa9d

```

and I also be Aceess Denies 😂

---

_[View the full topic](https://community.tradovate.com/t/i-can-send-oso-order-in-demo-but-access-denied-in-replay/4459)._