OAuth /v1/auth/me response schema and stable user identity in Tradovate Demo

Uncategorized
1

Hello Tradovate Developer Community,

We are implementing a strictly read-only OAuth integration against the Tradovate Demo environment.

Our OAuth registration grants only:

  • Account Information: Read only
  • Your User Information: Read only
  • All other permissions: Denied

The authorization callback and confidential-client token exchange completed successfully. The first authenticated API request was:

GET https://demo.tradovateapi.com/v1/auth/me
Authorization: Bearer <redacted>

The request was accepted, but our fail-closed validator could not reconcile the returned identity with the documented OAuthMeResponse contract. For security reasons, the raw response and all credentials were destroyed, so no sensitive values can be posted.

Could someone confirm:

  1. What is the current authoritative response schema for Demo /v1/auth/me?
  2. Is userId always present as a positive JSON integer?
  3. Can userId ever be absent, null, zero, or represented as a string?
  4. If userId is not the recommended stable identity, which field should an OAuth client use to bind the authenticated Tradovate user?
  5. Are both Account Information Read-only and Your User Information Read-only sufficient for /v1/auth/me?
  6. Can the response differ between trial, demo and live-enabled users?
  7. Is there an official example response or JSON schema for the current OAuth implementation?
  8. Should the client call a different read-only endpoint to establish authenticated user identity before requesting /v1/account/list?

Our intended flow is limited to:

OAuth authorization
→ token exchange
→ GET /v1/auth/me
→ GET /v1/account/list
→ select one uniquely identified Demo account
→ destroy credentials

No order, position, contract, market-data, WebSocket, live-account or mutation endpoints are involved.

Thank you.