Apps

An app acts on behalf of other STX members, using OAuth. Your users keep their own STX accounts and connect them to your app. They sign in on STX, approve the access you ask for, and can disconnect at any time. You never see their password, their keys or their funds, and nothing your app holds can move money.

How the protocol works, from the authorization code flow to scopes, tokens and errors, is covered under OAuth, in this section. These pages cover what you get and how to get access.

What you get

• Scoped access. Named slices of a member’s account, such as profile.read, balance.read, orders.read and orders.write. You ask for the fewest you need, and every token is confined to them. No scope moves money. See Scopes.
• Consent hosted by STX. Sign-in, sign-up, two-factor and the consent screen all run on STX. Members see your app’s name and logo, and can revoke it from Connected apps in their account. See Hosted pages.
• Member and app tokens. A member token to act for one member, a refresh token to keep that access alive, and an app token to read the market and event catalogue as your app. See Tokens and security.
• The same API. An access token is a bearer on the same REST API and WebSocket channels a signed request uses, limited to the scopes the member approved.
• Attribution. Every order your app places for a member is recorded as placed by your app.
• TypeScript and Python SDKs. @stxapp/stx-typescript and stx-python run the whole flow for you, from linking a member to refreshing and revoking their tokens. See With the TypeScript SDK and With the Python SDK.

Access

Access is self-serve. Sign up at apps.stxapp.io (STX Apps), confirm your email, create your organization and register your app, and you get demo credentials, for the US demo exchange and a member account with test funds to connect. Live access is coming soon in the US and Ontario; in Ontario an app reads public market data only and does not act for members.

Get demo access

Register your app in STX Apps with:

• an application name and logo, shown to members on the consent screen and in Connected apps;
• its application type, from the table below;
• one or more callback URLs (redirect URIs), where STX returns the member after consent. They are matched exactly, byte for byte, at both the authorize and token steps, except a local callback (localhost, 127.0.0.1, [::1]), which matches on any port. The allowed forms depend on your application type. None for a Server-to-server app. No fragment;
• the scopes your app may ever request: member scopes, app scopes, or both. Every request is narrowed against this list;
• the IP addresses your app writes from, as CIDR blocks (203.0.113.0/24, 2001:db8::/32; no wider than /8 for IPv4 or /32 for IPv6). Required for a write scope (orders.write, markets.write), optional otherwise. Calls that write from any other address are refused with 403 ip_not_allowed; reads and token requests work from any address. See IP allow-list. Developing locally? Add your own public IP.

You receive a client_id and, for a Web app or Server-to-server app, a one-time client_secret. The secret is shown once and cannot be recovered; store it on your server. Rotating it invalidates the old one immediately.

Application types

Type	For	Client secret	Callbacks in production
Web app	an app with its own server	yes	https only
Browser app	a single-page app with no server	no, PKCE only	https only
Mobile or desktop app	an installed app	no, PKCE only	https link, reverse-domain custom scheme (com.example.app:/callback), or http://localhost / 127.0.0.1 / [::1] on any port. See Callbacks for mobile and desktop apps
Server-to-server	your backend, no member sign-in (client_credentials)	yes	none

The type is fixed at registration. Outside production, every type with callbacks may also register localhost, 127.0.0.1 and [::1] callbacks (http or https) that match on any port, so you can develop locally.

What it takes to integrate

1. Get a demo client in STX Apps (see Get demo access).
2. Start from where you are: an app with its own accounts, a new app with no login yet, or an app on a login service. Each runs the authorization code flow to turn a member’s consent into tokens.
3. Call STX for the member with the access token as a bearer on /api/v1 and the WebSocket, limited to the effective scope.
4. Keep access alive by refreshing, and drop it cleanly when the member disconnects. See Tokens and security.

Sample app

Sideline is a demo app built on STX OAuth, published as a public example. It links a member’s account from its backend, reads their balance, positions and orders, places and cancels orders for them, streams their account data, reads public market data on its own app token, and unlinks on request. It is built on the TypeScript SDK and runs against the demo exchange with your demo client.

Try it live at sideline.sportsxapp.com. It runs against the US demo exchange: to link an account, sign up on demo.stxapp.io first. No real money is involved.

In this section

Hosted pagesConsent, sign-in and sign-up, and Connected apps, all hosted by STX.

Callbacks for mobile and desktop appsUniversal links and App Links, a custom scheme, or loopback, with iOS, Android and desktop examples.

With the TypeScript SDKConnect a member's STX account or sign them in with it, act for them, and disconnect, with @stxapp/stx-typescript.

OAuthStart from where you are, then the protocol underneath: authorization code flow, scopes, tokens, discovery and errors.