Partner Platform

Build a full trading platform, powered by CrossTrade. Your application provides the customer experience; CrossTrade provides the broker connection, trading endpoints and automation services underneath it.

The Partner API is your onboarding and authentication mechanism for those services. Create a funded CrossTrade account for each user, send them through hosted Connect, and exchange their consent for a member token. Use that token directly on the Trading API to read accounts, positions and orders or execute trades, and on the Management API to configure supported monitors, trade copiers and ATM templates.

How the APIs fit together

API	What your app does	Credential
Partner: /v1/api/partner	Onboard members, issue Connect links, track connection status, manage funded seats, read usage and events	Your service's partner token
Trading: /v1/api/tv	Read the member's Tradovate accounts, positions, orders and fills; place and manage orders	That member's access token
Management: /v1/api/manage	Read and configure supported Tradovate automation	That member's access token

You use the same OAuth client for both token types. The partner token identifies your service. Each member token identifies one user's authorization to that client. Store the token pair against your own external_id, and select that user's token whenever your backend makes a Trading or Management request. The token determines the user; a Trading API request does not take an external_id to switch users.

Supported access

Delegated trading currently uses Tradovate. Delegated Management access covers Tradovate monitors, copiers and ATM templates, plus discovery and your app's audit records. Availability depends on your active Partner subscription, the member's consent and plan entitlements, and your enabled environments. Read GET /v1/api/partner/me for your service policy. The examples use demo accounts; live access also requires live_enabled to be true.

Endpoint reference

Every /v1/api/partner endpoint has its own method-labeled reference under Partner API → Endpoints in the sidebar. Each page includes headers, parameters, Python/JavaScript/cURL examples, responses and errors.

All routes below use your service's partner token. Paths are relative to https://app.crosstrade.io/v1/api/partner. partner:provision includes partner:read.

Endpoint	Path	Scope
GET Partner Profile	/me	partner:read
POST Create Member	/users	partner:provision
GET Members	/users	partner:read
GET Member	/users/{external_id}	partner:read
POST Create Connect Link	/users/{external_id}/connect-link	partner:provision
POST Pick Up Authorization Code	/users/{external_id}/authorizations/{flow_id}/code	partner:provision
POST Revoke Member	/users/{external_id}/revoke	partner:provision
POST Reopen Member	/users/{external_id}/reopen	partner:provision
GET Broker Status	/brokers	partner:read
GET Member Broker Status	/users/{external_id}/brokers	partner:read
GET Events	/events	partner:read
GET Usage	/usage	partner:read

Token issuance, refresh and revocation use the shared /v1/oauth endpoints described in Partner Authentication.

Becoming a partner

The Partner Platform is a CrossTrade subscription tier. Upgrade an eligible CrossTrade account to the Partner plan from My Account, accept the Partner Agreement, and the dashboard walks you through three steps. An account already funded by a partner cannot itself become a partner; use a separate account.

1. Enter your business name. It appears on the agreements your customers accept, and CrossTrade derives a permanent account identifier from it (CrossTrade, LLC becomes crosstrade_llc), which becomes the plan name partner-<identifier> on every account you create. Neither can be changed later.
2. Create your API client under API Keys. The client secret is shown once.
3. Send your first request. Until the business name is set, member creation answers 409 partner_tag_required.

Leaving the Partner plan ends the platform for your account immediately: credentials stop working and your members are released. Seat-days used up to that moment are billed on the final usage invoice at the end of the current billing period. If you already have a CrossTrade subscription, upgrading switches that subscription to the Partner plan in place; otherwise you check out as a new subscriber.

Two tokens, separate responsibilities

Who	Credential	Surface
Partner service	Partner token (client_credentials)	/v1/api/partner/* control plane: members, usage, events, your own policy
Member (through your app)	Member token (authorization_code + PKCE, obtained after hosted Connect)	/v1/api/tv/* Trading API and /v1/api/manage/* Management API, within the member's grant

A partner token cannot place trades or read a member's positions. A member token cannot create or revoke funded seats. They have separate audiences (the APIs a token is valid for), even though both are issued to your OAuth client. One member token can carry both Trading and Management audiences when its approved scopes cover both.

Lifecycle at a glance

1. Create a member with POST /v1/api/partner/users. A new email gets a CrossTrade account funded by you. An email already attached to a CrossTrade account returns 409 email_in_use; enroll with a different address.
2. Send the member the Connect link CrossTrade returns. The link is the member's access (no sign-in, no email code): the hosted portal shows the terms, links the member's Tradovate login and asks what your app may do.
3. Exchange the authorization code for a member access token and refresh token at POST /v1/oauth/token.
4. Call the Trading and Management APIs with that member's token in Authorization: Bearer .... The code guide shows account and position reads. Trading commands require tv:trade and an Idempotency-Key; Management writes require manage:write, with additional trading authority to start automation.
5. Follow the lifecycle through GET /v1/api/partner/events or signed webhooks. Revoke a seat with POST /v1/api/partner/users/{external_id}/revoke when the member leaves your service.

Billing is per seat-day, computed by CrossTrade from the member's seat and your service state, and reported to Stripe on your subscription. See Billing and usage.

The member experience

While a partner-created seat is open, the account is managed by your service and cannot sign in to the ordinary CrossTrade dashboard. Hosted Connect is the member's access to linking and consent. Your app handles their day-to-day experience and support, including requests to end the connection.

Revoking the seat ends your funding and credentials and releases the account to the member. CrossTrade emails them instructions for setting a password. Their broker links and saved settings remain. Copiers created by your app stop executing when their authority ends; protective monitors continue enforcing their limits. Revocation itself does not flatten positions or cancel protective orders.

Pages in this section

• Code guide: onboarding through Trading and Management reads in Python, JavaScript and cURL, plus a complete Python client.
• Partner Authentication: visual flow, tokens, scopes, refresh rotation, revocation.
• Members: the control-plane routes and the member model.
• Hosted Connect: what the member sees and what your app receives.
• Delegated trading: operation matrix, identity rules, idempotency.
• Delegated management: monitors, copiers and ATM templates your app may create.
• Events and webhooks: the durable feed and signed delivery.
• Billing and usage: seat-days and the usage ledger.
• Errors: response formats, common error codes and recovery steps.