OPT-o-MON

Connecting TastyTrade

Last updated: 2026-10-24

tastytradeonboardingbrokervault

Connecting TastyTrade

You connect TastyTrade with an API app that you create in your own TastyTrade account. OPT-o-MON keeps that app's credentials in your vault, encrypted in your browser.

Before you start

1. In TastyTrade: an app and a grant

  1. On my.tastytrade.com, go to Manage → My Profile → API → OAuth Applications and click + New OAuth client. Enter a redirect URI (a full URI, for example https://optomon.io) and select the scopes read, trade and openid.
  2. Copy the Client Secret. It is shown once. Regenerating it invalidates any active grants.
  3. Back on the same page, click Manage next to the app, then Create Grant. This shows the refresh token.

The refresh token does not expire, so this is a one-time setup. If the grant is lost or compromised, delete it on the same API page and create a new one.

2. In OPT-o-MON: paste and check

  1. Open Settings → Security and find Connect TastyTrade in the vault panel.
  2. Paste the client secret and the refresh token, then choose Check with TastyTrade and save.
  3. OPT-o-MON asks TastyTrade before it saves anything: it trades the refresh token for an access token, then reads your accounts with it. If both work, the credentials are saved and you see which TastyTrade (production or sandbox) and the last four digits of your account. If TastyTrade refuses, you see what TastyTrade said, and nothing is saved.

Afterwards, Check connection runs the same check on what is stored, and Remove from vault deletes it.

What the server sees

The client secret and refresh token are encrypted in your browser before they are stored; the server keeps only the encrypted form. Access tokens from TastyTrade last 15 minutes. When one is due, your browser decrypts the credentials and sends them to OPT-o-MON's server for that one exchange with TastyTrade; each broker request carries the current access token the same way. None of it is kept. So: the server never keeps a readable copy.

Advanced: a session token

If you already have a TastyTrade API session token (what TastyTrade's API returns when you sign in to it), you can paste it under Advanced: paste a session token instead. It is checked the same way. TastyTrade expires session tokens, so you would paste a new one from time to time; the API app does not need that.

If the check fails

  • TastyTrade rejected the client secret. Use the client secret of the same application you created the grant on. If you regenerated the secret, its earlier grants no longer work: create a new grant and paste both again.
  • TastyTrade rejected the refresh token. Delete the grant on the API page, create a new one, and paste the new refresh token.
  • You are signed out. Sign in again. Your vault will need unlocking again too.

Next