
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@marknokes/tdameritrade
Advanced tools
Free, open-source Node.js client for the TD Ameritrade Trading Platform.
NOTE This is a fork of @knicola/tdameritrade
It's used in the automated day trading app Trade For Me. Visit tradeforme.money for more information, thinkorswim indicators and algo trading software.
The original author says this library is still in its early stages of development and thus far from ready for production use. All of the features used by Trade For Me have been tested successfully.
For details concerning the latest update please read the CHANGELOG.
The API client is very close to being complete. All documented API methods have been implemented.
The data streamer implements most of what the documentation talks about except Actives, Level 1 Options and Level 2 order book. Documentation also mentions services NEWS_STORY and NEWS_HEADLINE_LIST but does not provide any information.
An attempt to provide typescript definitions is also in progress.
Using npm:
$ npm install @knicola/tdameritrade
Using yarn:
$ yarn add @knicola/tdameritrade
See API Docs file.
In order to use TD Ameritrade's API services you will need a Consumer Key (also called Client ID and API Key). To get one first create a developer account and add a new app. The key will be listed under the newly created app.
SSL certificate is required for oauth2 authorization.
const { TDAmeritrade } = require('@knicola/tdameritrade')
const td = new TDAmeritrade({
apiKey: 'your-consumer-key',
redirectUri: 'https://localhost:8443',
sslKey: 'path/to/selfsigned.key',
sslCert: 'path/to/selfsigned.crt',
})
// event will fire once the local web server
// is ready for the oauth2 authorization.
td.on('login', url => {
// use this to print the td oauth2 url to console
// or to open the url directly in the browser.
console.log(url)
})
// event will fire every time the token is renewed.
td.on('token', token => {
// use this to know when a new access token is
// issued or to save the token to a file.
console.log(token)
})
// an all-in-one entry point which will determine
// whether authorization is required or, if the
// access token expired, whether to renew it.
td.login().then(async () => {
const { candles } = await td.getPriceHistory('SPY')
console.log(candles)
// the websocket interface will be instantiated automatically.
// for now, it will choose the first available account.
const streamer = await td.streamer()
// you could also choose to instantiate it
// manually with `new td.TDStreamer(...)`
// event will trigger once the streaming client is
// connected *and* authenticated to the server.
streamer.on('authenticated', () => {
// we can now interact with the server
streamer.subsChartEquity('SPY')
})
// event will trigger everytime the streaming server
// sends us a new candle (that is every minute).
streamer.on('chart', data => {
console.log(data)
// choose to save the data or determine
// whether to place a buy/sell order.
td.placeOrder({ ... }).then(res => {
// ...
})
})
// connect to the streaming server
streamer.connect()
})
The .login() and .authorize() methods are not available in the browser since they depend on Node.js specific modules. Either the authorization code or the issued access and refresh token will have to be provided by the server hosting the website.
Authorization code:
const { TDAmeritrade } = require('@knicola/tdameritrade')
const td = new TDAmeritrade()
const authCode = 'provided by the server'
// the config will update automatically
// with the access and refresh token.
await td.getAccessToken(authCode)
const { candles } = await td.getPriceHistory('SPY')
Access and Refresh token:
const { TDAmeritrade } = require('@knicola/tdameritrade')
// provided by the server
const token = {
apiKey: 'your-consumer-key',
accessToken: 'your-access-token',
refreshToken: 'your-refresh_token',
accessTokenExpiresAt: '2020-01-01T01:31:01.000Z',
refreshTokenExpiresAt: '2020-03-31T01:01:01.000Z',
}
const td = new TDAmeritrade(token)
const { candles } = await td.getPriceHistory('SPY')
In most cases, a self-signed certificate will be enough. You can generate one using openssl:
$ openssl req -x509 -nodes -newkey rsa:2048 -keyout selfsigned.key -out selfsigned.crt -batch
# OR
$ openssl req -x509 -newkey rsa:2048 -nodes -sha256 -out selfsigned.crt -keyout selfsigned.key \
-subj '/CN=localhost' -extensions EXT -config <( \
printf "[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
This project is open-sourced software licensed under the MIT license.
FAQs
TD Ameritrade Library for Node.js
We found that @marknokes/tdameritrade demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.