TapeTutor

01 · Crypto API

Sign here. v2 is the path. There is no Robinhood password on this page.

US Robinhood Crypto customers create credentials on the web, classic experience, not the phone app. Keys issued after 13 Aug 2024 look like rh-api- followed by an id. The private key is a 32-byte Ed25519 seed. This desk can create the pair. You paste the public key into Robinhood. They give you the API key. The seed never leaves this browser. About 100 requests a minute, with a short burst. The signature dies in about 30 seconds, so this desk signs on the click.

1. Create the key pair. Copy the public key. It is standard base64 of the raw 32-byte key, not a PEM and not hex.
2. Register that public key under crypto API credentials. Paste the API key they show, and the private seed if you did not just generate it here.
3. Stay on v2. Read the book: account, then holdings, then orders. The account number is saved on this device and appended to the later calls.
4. Quote, then estimate. Neither one trades. Check the pair. If the minimum is larger than your quantity, change the size.
5. Pick market, limit, stop, or stop-limit. Market is an asset quantity. The others can be coins or dollars, never both, plus the price. Type PLACE.
6. Cancel uses the order id from Orders and the word CANCEL. v1 is still here for an older key. It does not ask for account_number. New work belongs on v2.

message = apiKey + timestamp + path + method + body
timestamp = unix seconds, 10 digits
path includes the query, exactly as sent

GET  /api/v2/crypto/marketdata/best_bid_ask/?symbol=BTC-USD
body empty

GET  /api/v2/crypto/trading/holdings/?account_number=YOUR_ACCOUNT
body empty

POST /api/v2/crypto/trading/orders/?account_number=YOUR_ACCOUNT
{"client_order_id":"<uuid>","side":"buy","type":"market","symbol":"BTC-USD","market_order_config":{"asset_quantity":"0.001"}}

Headers:
x-api-key
x-timestamp
x-signature   base64 Ed25519 of the message
content-type  application/json; charset=utf-8   only when there is a body

No separators. No JSON whitespace you did not sign. A 64-byte seed is seed then public key — only the first 32 bytes sign.
Host: trading.robinhood.com
Docs: docs.robinhood.com/crypto/trading

Robinhood's published sample. v1 path. Not a key to import.

api key     rh-api-6148effc-c0b1-486c-8940-a1d099456be6
timestamp   1698708981
path        /api/v1/crypto/trading/orders/
method      POST
body        {"client_order_id":"131de903-5a9c-4260-abc1-28d562a5dcf0","side":"buy","type":"market","symbol":"BTC-USD","market_order_config":{"asset_quantity":"0.1"}}

message = those five, concatenated, nothing between them
signature   q/nEtxp/P2Or3hph3KejBqnw5o9qeuQ+hYRnB56FaHbjDsNUY9KhB1asMxohDnzdVFSD7StaTqjSd9U9HvaRAw==

v2 is the same recipe. The path gains ?account_number= before you sign.

02 · Order bodies

One config object. The type name has to match it.

A place call sends symbol, a fresh client_order_id, side buy or sell, and type. Then exactly one config. Strings, not numbers, so the signature matches the body. Prices and sizes are positive decimals. time_in_force on this desk is gtc. These shapes are examples of the wire, not a size you should use.

{"asset_quantity":"0.001"}

{"asset_quantity":"0.001","limit_price":"1.00","time_in_force":"gtc"}

{"asset_quantity":"0.001","stop_price":"1.00","time_in_force":"gtc"}

{"asset_quantity":"0.001","stop_price":"1.00","limit_price":"0.99","time_in_force":"gtc"}

Common fields on every order: client_order_id, side, type, symbol. v2 also needs account_number on the query string, and that query is part of the signed path. Equities, options, and futures do not belong on this host.

03 · Agentic MCP

OAuth into a ring-fenced account. The rest of the book stays read-only.

The server is https://agent.robinhood.com/mcp/trading. A call without a token returns 401. This desk registers a public client, opens Robinhood login with PKCE S256, and stores the bearer in this browser. Tool names come from tools/list after you connect. The table is the beta surface to expect, not a hardcoded client. You remain responsible for every order. Robinhood says the agent can be told to trade without a second approval — this desk refuses that. Writes wait for PLACE.

1. Connect on a desktop browser. Mobile onboarding is not the supported path. Approve only the agentic account, and fund it with money you can lose.
2. Redirect is this origin plus /demos/robinhood. No query string. The token endpoint has no useful browser CORS, so the exchange happens on this site and the token comes straight back to your browser. It is not written to a database.
3. Read portfolio. The bundle calls the read tools the server actually advertised.
4. Draft args asks Grok for JSON that matches the live schema. It fills the box. It does not call the tool. Edit it. review before place.
5. place_equity_order and cancel_equity_order stay inert until PLACE. Crypto on this pipe, if the tool exists for your account, still cannot transfer, stake, or lend, and is not offered in every state.

Same URL, other clients

Official walkthrough: robinhood.com/us/en/support/articles/agentic-trading-overview. Those clients can place a trade if you tell them to. This desk will not do it for them.

04 · Plaid

Holdings in. Transactions in. Nothing out.

Plaid Investments returns accounts, holdings, securities, and transactions. It cannot place a Robinhood order. Login happens inside Plaid Link, on Robinhood, not in a password box here. The secret is sent for that one call and is not stored on our side. The access token stays in this browser until you forget it.

1. Paste client_id and secret. Pick sandbox, development, or production. Enable Investments on that client before production.
2. Open Link and search Robinhood. Sandbox Link accepts user_good, pass_good, and 2FA 1234. That path needs no institution id.
3. Holdings are POST /investments/holdings/get. Ticker lives on the security. Quantity and institution_value live on the holding. Match them on security_id.
4. Transactions are POST /investments/transactions/get with start_date and end_date. The desk defaults to the last 90 days and asks for 50 rows. Use it to see whether a name was a planned buy or a chase.
5. Refresh is POST /investments/refresh. It asks the institution for a new pull. Read holdings again after it settles. It still cannot trade.
6. Create sandbox item is POST /sandbox/public_token/create, then an exchange, and only on the sandbox host. Paste the institution id from your Plaid dashboard. If that institution does not support Investments, you see Plaid's error. This desk will not invent a second id.

05 · What Grok may see

A live book without a sentence is still a lottery.

Defend, Brief, and Draft args are separate clicks. They share a cap of six asks on this device, including the practice desk above. Nothing runs on load. Nothing retries in a loop.

• Defend is four lines: Defense, Verdict, If -12%, Size. One focus name, the drop test.
• Brief is the whole book: Book, Weakest, Cash, Refuse. It cannot place an order.
• Draft args returns one JSON object for the tool you picked. You edit it. A write still needs PLACE, then Run tool.
• No thesis → LOTTERY or REFUSED. 0DTE is not a strategy on any pipe.
• Forget keys wipes this browser. On a shared computer, forget them before you leave.

Defense: You hold BTC as a reserve only if a 40% drawdown is boring. Otherwise the size is the bug.
Verdict: SIZE DOWN
If -12%: 12% is a Tuesday. If it changes your week, cut.
Size: A slice you would not check at dinner.

06 · A session

Read, then sentence, then — maybe — an order.

Not financial advice. The buttons are real once your own keys are in. The practice book above this guide is mock and needs none of them.

1. Crypto: Read the book. If the account number did not fill, the response is in Raw and you can paste it. Quote the pair. Estimate. Only then type PLACE.
2. MCP: Connect once. Read portfolio. Draft a review_equity_order. Read the warnings in the next response yourself. place_equity_order is a second PLACE, not a continuation.
3. Plaid: Link, or a sandbox item if you are building. Holdings for the sentence. Transactions so a chase shows up as a chase. Refresh if the numbers look stale.
4. Defend the focus. Brief the book if the book is the question. Copy the sentence. Close the tab or forget the keys.

07 · When it breaks

The failure is usually the signature, the account number, or the wrong account.

Read the status line on the desk before you rotate keys. The same line is explained under the pipes. Most rejects are one of these. The next move is never another Place click.

08 · Read the response

The field that matters is rarely the first number.

Raw response is the source. These are the names the official crypto docs return, plus the Plaid join. If a name is missing here, do not invent a meaning for it. First page only. This desk does not follow a cursor.

09 · Where it goes

The seed stays. The signature travels once.

Forget keys deletes this browser's copy. We do not keep another. A shared computer should forget them before you leave.

10 · Build the same pipe

Steal the contract. Do not steal a session.

This is the wedge: a sentence on a real book, official pipes only, a human gate on every write. The calls below are what this desk will actually do.

11 · Glossary

The words the status line assumes you know.

Look them up from the search at the top. The definition is the next click, not a textbook.