Skip to main content

Create an API Client

Last updated November 4, 2026

An API client is the credential your own code signs in with: a client id and a client secret, with the permissions and limits you choose. You create it on the tradeSteward website, and your program never sees your password.

Create the client

  1. Open Connected Apps from the account menu and find the Create API client card.
  2. In Name, say what the client is for, such as Reports. The name is how you tell your clients apart, and it is what you see on an approval request.
  3. Under Permissions, switch on what the client may do, grouped under Bots and Backtick. Only the permissions your plan covers are listed. Most start on. Permanently delete Backticks starts off, and so do the three that start trading: Edit live bots, Enable bots and Resume all trading.
  4. Select Create API client.

Switching on one of the three that start trading shows an Ask me to approve each request switch under it, which starts on. Giving a client Edit live bots or Enable bots asks you for a fresh passkey or authenticator code. Safeguards explains those three permissions and the approval, and Permissions and Limits what each of the others allows.

The client acts only on the account that created it. An account can have 5 API clients. Creating a client sends you a required notice, API Client Created, by alert and email.

Copy the id and the secret

When the client is created, a window shows its Client id and Client secret, each with a Copy button. The client id starts with tsk_ and the secret with tss_. The secret is shown only once: copy both now and keep them somewhere safe, such as your program's secret store. The secret cannot be shown again. If you lose it, rotate the secret to get a new one (see below).

  Treat the client secret like a password. Anyone who has it can do whatever the client is allowed to do. If you think it has leaked, rotate the secret or delete the client on the Connected Apps page.

The client's card

The new client appears under API clients with its name, its status, its Client id and the date it was Created, in US Eastern time. The card holds the client's settings, which you can change at any time:

  • Its permissions, with the same switches as when you created it.
  • Only these accounts, under Accounts, limits the client to the broker accounts you switch on.
  • Only bots this client creates, under Scope, hides every bot the client did not make.

Select Save changes to keep what you changed. The client's next request uses it. The card also has the Suspend (or Re-enable), Rotate secret and Delete buttons.

Creating a client, rotating a secret and re-enabling a client you suspended yourself share one hourly and daily allowance. Re-enabling clients after a sign-in change is not counted.

Rotating the client secret

Select Rotate secret on the client's card. Rotating:

  • replaces the secret with a new one, shown once in the same window as at creation, and the old secret stops working at the same moment;
  • ends every access token the client holds, so programs still using them get 401 invalid_token on their next request and must ask for a new token with the new secret;
  • keeps the client itself, its name, permissions and limits, exactly as they were;
  • sends you a required notice, API Client Secret Replaced, by alert and email.

A suspended client can rotate the secret and stays suspended. Rotate the secret whenever you think it may have leaked, and when someone who knew it should no longer have access. For a client that may turn bots on or edit live bots, tradeSteward asks you to confirm it is you first.

Rotate, copy the new secret into your program's configuration at once, then restart the program. Until it restarts, its requests answer 401 invalid_token and its token requests answer 401 invalid_client, so rotate when a short stop is acceptable.

Deleting a client

Delete on the client's card removes the client for good. Its tokens and its connection are ended in the same step, so every program using it gets 401 invalid_token and its token requests answer 401 invalid_client. A Backtick run the client had scheduled and that has not started yet is cancelled. Bots and Backticks the client created stay in your account. There is no undo; create a new client instead.

To stop a client for a while without losing it, select Suspend instead. Suspension and re-enabling explains what your program sees.

Related