tastytrade API for Automated Trading (2026): OAuth, Sandbox, Order Types, Rate Limits, Cost, and What Third-Party Apps Can Do

Yes, tastytrade has an API for automated trading, and it is one of the few retail broker APIs whose terms say in writing that a third-party platform may trade on a customer's behalf. It is called the Open API, it is free, it is documented at developer.tastytrade.com, and as of 2026 it is OAuth2 only: the old username-and-password session login was switched off in the February 11, 2026 release. This page is the practical reference for it, written from two sides: tastytrade's own documentation, read on November 2, 2026, and what we learned building and operating a verified third-party integration against it since September. If you only want to connect an account to a no-code platform, the setup guide is shorter. If you want to know what the API can and cannot do before you build on it or trust something built on it, read on.

What the API covers

• Accounts: balances, buying power, net liquidating value, positions, transactions and margin requirements, with a dry-run endpoint for margin.
• Instruments: equities, equity options, futures, futures options, and cryptocurrency instruments. One caveat in the current order documentation: "Cryptocurrency trading is currently disabled through the API."
• Orders: single-leg and multi-leg orders, a dry-run endpoint that validates an order and returns its cost and margin effect without sending it, and complex orders (OTO, OCO, OTOCO, PAIRS).
• Market data: real-time and historical quotes, option chains with Greeks, and market metrics such as IV rank and liquidity, delivered over the DXLink streaming protocol.
• Tooling: 16 OpenAPI 3.1 specs, a Postman collection, an AsyncAPI spec for streaming, and an open-source MCP server for AI assistants. There is no official SDK; the community Python libraries are unofficial.

Authentication: OAuth2, personal apps and verified third parties

Everything runs on an OAuth2 access token in the Authorization header, and every request, including token requests, must carry a User-Agent header in product/version form or it is rejected with a 401 that looks like a credential problem. There are two kinds of apps, per the OAuth2 guide:

• Personal apps. You create one under My Profile, then API, then OAuth Applications, pick scopes, and create a personal grant that gives you a refresh token for your own account. The docs are explicit that a personal app is "restricted to your account only" and "other tastytrade users cannot connect to it." This is the route for your own bot or for the MCP server.
• Verified third-party apps. For other customers to connect, the developer passes tastytrade's trusted third-party verification, which reviews how the app handles data, and the process starts by emailing api.support@tastytrade.com. Verified apps use the standard authorization-code flow: the customer is sent to tastytrade's sign-in page, approves the scopes, and is redirected back with a code the app exchanges for tokens.

Scopes are read, trade and openid. Reads need read; anything that changes state, including orders, needs trade. For those two scopes the customer must have two-factor authentication enabled on the tastytrade login before the grant can be made, and the authorization page asks for a 2FA code after the password. That requirement is the single most common reason a connect button appears to do nothing.

Token behavior is where tastytrade differs most from other brokers. Access tokens are signed JWTs that last 15 minutes. Refresh tokens do not expire and are not rotated: refreshing issues a new access token and the same refresh token stays valid for the life of the grant. In practice an app mints a fresh access token every few minutes from a credential that never needs renewing, which is why a tastytrade connection does not expire until the customer revokes it. Compare that with Schwab's weekly re-authorization. The flip side is in the docs too: regenerating a client secret invalidates every active grant, and a lost or compromised third-party refresh token is a call to API support, not a self-service reset.

Our own verification, for scale: we emailed api.support on September 9, 2026, passed KYC on September 22 after they reviewed the site, submitted the app details (name, redirect URI, scopes read and trade) the same day, and had production OAuth credentials on September 23. The connection went live for members on September 24. Two weeks door to door, with the KYC step being the only wait.

The sandbox

The cert environment at api.cert.tastyworks.com is, in tastytrade's words, "a full copy of the tastytrade API backed by simulated money." Paths, payloads and header rules match production, and you create a sandbox user, customer record and funded account through a sign-up tool in the browser. Per the sandbox page, what to expect:

• Separate credentials. The sandbox is a different OAuth application from production; a token for one fails against the other with invalid_credentials.
• Simulated fills. Orders never reach a market. Equity fills come back from a venue called MARKET_SIMULATOR_A, priced from the quote's mid rounded to the tick, and a few scripted tickers return fixed outcomes.
• No REST market data. The market-data and market-metrics endpoints return HTTP 502 in cert. The documented workaround is to read quotes from production and submit orders to the sandbox with two sets of credentials. Streaming quotes have worked from a delayed feed.
• Daily resets. Trades, transactions and positions are cleared every 24 hours; users and accounts persist.
• No paper trading in production. The API has no paper flag. Platforms that offer paper trading on a tastytrade account run their own simulation, or point you at the cert environment.

Order types and complex orders

From the orders concept page: Limit, Market, Stop (a market order with a stop trigger), Stop Limit, and Notional Market, which buys a dollar amount instead of a quantity. Time in force is Day, GTC (not for market orders) or GTD with a date. Equity, futures and crypto orders are single-leg; equity options and futures options allow up to four legs. Equity quantities are whole numbers; decimal quantities are described only for crypto, and the notional type is documented for crypto and "eligible equities" without defining eligible.

Complex orders go to a separate endpoint. OTO sends a trigger order live and routes up to three child orders when it fills. OCO sends the children live with no trigger and cancels the rest when one fills. OTOCO is the bracket: a trigger plus one to three OCO pairs that sit in Contingent status until the trigger fills, with a price check that rejects a profit target below the entry or a stop above it, and no market orders allowed among the children. PAIRS orders are the only ones that can be edited after submission. BLAST is deprecated and not supported in any environment.

What that means for a bot: a bracket is available, but only as a complex order with limit or stop children, not as flags on a simple order the way Alpaca does it. Our order-types comparison sets tastytrade next to five other broker APIs, and the stop-loss post explains where each platform's exits live when the connection drops.

Rate limits, retries and duplicates

tastytrade does not publish a REST quota. The rate-limits guide says the API throttles by "reasonable thresholds rather than a published per-endpoint quota," a 429 carries no rate-limit headers, and the only correct response is exponential backoff with jitter: "Do not tight-loop retries, that's what triggers the threshold in the first place." Too many failed logins block the IP for about eight hours. The streaming side has hard numbers: 5 concurrent DXLink sessions per set of credentials, 25,000 subscriptions per session, 100 per event type for candles, orders and series, and 10,000 subscription changes per minute, and "exceeding them fails rather than throttles."

Duplicates are the developer's problem. The FAQ is direct: the API does not de-duplicate retried submissions, so the pattern is dry-run first, submit with a unique external-identifier, and after a timeout or 5xx check existing orders before resubmitting. We use the external-identifier as our own dedupe key for exactly this reason.

What it costs, and what the terms require

The API itself is free; there is no developer fee, data fee or minimum. You pay tastytrade's normal commissions on what the software trades, per the pricing page: $0 on online stock and ETF trades, $1 per options contract to open capped at $10 per leg and $0 to close, plus exchange, clearing and regulatory fees. The API terms add obligations that matter if you build or choose a platform: third-party integrators may buy and sell for customers enrolled in their service; they must use OAuth and never store credentials; they must disclose to customers what data they keep; they are liable for errant orders; and they may not redistribute tastytrade market data, which is why a multi-user platform has to run its scanner on its own data feed and use tastytrade quotes only per customer, per token. tastytrade can also end an integration at its discretion for regulatory or reputational risk.

The MCP server: an AI assistant on the same API

On August 31, 2026 tastytrade released an open-source MCP server that connects Claude Desktop, Claude Code, Cursor, VS Code and other clients to a tastytrade account through the Open API. It runs on your own machine with a personal OAuth app, shows a cost estimate before anything hits the market, asks permission the first time each tool is used, and requires a separate confirmation for any action that places or modifies an order. tastytrade says it does not endorse or recommend any connected AI system. It is an assistant with a confirm button, not an auto-trader; our October note on broker AI programs covers the distinction and the MCP docs have the setup.

What we learned running a verified integration

JorgAI connects members' tastytrade accounts through the verified third-party flow and trades stocks and ETFs in them, so the following are observations from live orders, not the documentation:

• "Opening market orders not allowed when market closed." tastytrade rejects an opening market order outside regular hours rather than queueing it. Our scanner runs during the session, so this only appears if a signal lands at the bell; it is the right default.
• "This order contains a leg with an invalid symbol." Non-standard tickers, warrants for example, whose dot notation the API does not accept. Filtering to common stocks and ETFs removes it.
• Whole shares. Our position sizing converts a dollar amount to a whole-share quantity for tastytrade; the notional order type exists but we do not rely on it for equities while the docs leave "eligible equities" undefined.
• Exits. Because a bracket is a complex order rather than a flag on the entry, our entries are plain orders and our own server-side monitors own the stop and target, the same design as our Tradier fallback. The stop-loss post is candid about what that means if a connection drops.
• Tokens. In operation since launch the refresh token has behaved as documented: the 15-minute access token is minted on demand and cached, and nothing has needed re-authorizing.
• Market data. The scanner runs on our own feed. tastytrade quotes are read only with a member's own token, for that member, to honor the no-redistribution term.

If you want to use the integration rather than build one, the tastytrade page has the connection steps and limits, and the bots comparison lists every platform we know of that connects. You can start a trial here.

Quick answers

Does tastytrade have an API for automated trading?

Yes. The tastytrade Open API supports accounts, orders including multi-leg and complex orders, and market data, authenticated with OAuth2. Its terms allow verified third-party platforms to trade on behalf of enrolled customers, and tastytrade also publishes an MCP server for AI assistants.

Is the tastytrade API free?

Yes. There is no API fee, data fee or minimum balance to use it. You pay tastytrade's standard commissions and fees on the trades it places.

Does the tastytrade API have paper trading?

Not in production. The sandbox at api.cert.tastyworks.com simulates fills with pretend money, uses separate credentials, serves no REST market data, and resets every 24 hours. Paper trading inside a third-party platform is that platform's own simulation.

Is there a tastytrade Python SDK?

Not an official one. tastytrade publishes OpenAPI specs, a Postman collection and an MCP server; the Python libraries you will find on GitHub and PyPI are community projects.

What are the tastytrade API rate limits?

Unpublished for REST: tastytrade throttles by thresholds it does not disclose and returns a bare 429, so clients back off with jitter. Streaming has fixed caps: 5 sessions, 25,000 subscriptions per session, 10,000 subscription changes per minute.

Can another tastytrade user connect to my OAuth app?

Only after tastytrade verifies it as a trusted third-party application, which starts with an email to api.support@tastytrade.com and a data-handling review. A personal app is restricted to the account that created it. Our Option Alpha vs tastytrade page explains how the verified platforms, and their free-with-tastytrade deals, compare.