# OAuth /v1/auth/me response schema and stable user identity in Tradovate Demo

**URL:** <https://community.tradovate.com/t/oauth-v1-auth-me-response-schema-and-stable-user-identity-in-tradovate-demo/12815>\
**Category:** Uncategorized\
**Created:** [August 26, 2026, 8:16am UTC](https://community.tradovate.com/t/oauth-v1-auth-me-response-schema-and-stable-user-identity-in-tradovate-demo/12815 "2026-08-26T08:16:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZQOS](https://avatars.discourse-cdn.com/v4/letter/z/f08c70/32.png) [@ZQOS](https://community.tradovate.com/u/ZQOS)\
**Post date:** [August 26, 2026, 8:16am UTC](https://community.tradovate.com/t/oauth-v1-auth-me-response-schema-and-stable-user-identity-in-tradovate-demo/12815/1 "2026-08-26T08:16:45Z")

</div>

Hello Tradovate Developer Community,

We are implementing a strictly read-only OAuth integration against the Tradovate Demo environment.

Our OAuth registration grants only:

- Account Information: Read only
- Your User Information: Read only
- All other permissions: Denied

The authorization callback and confidential-client token exchange completed successfully. The first authenticated API request was:

```auto
GET https://demo.tradovateapi.com/v1/auth/me
Authorization: Bearer <redacted>

```

The request was accepted, but our fail-closed validator could not reconcile the returned identity with the documented `OAuthMeResponse` contract. For security reasons, the raw response and all credentials were destroyed, so no sensitive values can be posted.

Could someone confirm:

1. What is the current authoritative response schema for Demo `/v1/auth/me`?
2. Is `userId` always present as a positive JSON integer?
3. Can `userId` ever be absent, `null`, zero, or represented as a string?
4. If `userId` is not the recommended stable identity, which field should an OAuth client use to bind the authenticated Tradovate user?
5. Are both Account Information Read-only and Your User Information Read-only sufficient for `/v1/auth/me`?
6. Can the response differ between trial, demo and live-enabled users?
7. Is there an official example response or JSON schema for the current OAuth implementation?
8. Should the client call a different read-only endpoint to establish authenticated user identity before requesting `/v1/account/list`?

Our intended flow is limited to:

```auto
OAuth authorization
→ token exchange
→ GET /v1/auth/me
→ GET /v1/account/list
→ select one uniquely identified Demo account
→ destroy credentials

```

No order, position, contract, market-data, WebSocket, live-account or mutation endpoints are involved.

Thank you.