Schwab connection

Originator and date

AlertDesk's maker, 10/12/2026, as the first slice of a broker connection: sign in to Schwab and keep the sign-in fresh, nothing more. Each user brings an app key of their own from Schwab's developer site; an app key must be the user's own, never shared with another program on the same login (below).

Industry sources read

Schwab's Trader API and its sign-in (OAuth 2.0), from Schwab's developer portal (developer.schwab.com): the authorize address (api.schwabapi.com/v1/oauth/authorize), the token address (api.schwabapi.com/v1/oauth/token), an access token good for 30 minutes and a refresh token good for 7 days. No other program's code or sign-in is used.

What prompted it

Positions and, later, option chains with delta and theta straight from the broker, which Yahoo's data doesn't have.

What we changed and why

Only the sign-in and its refresh, so the connection could be watched before anything reads the API. Testing showed that an app key shared with another program on the same Schwab login fails: Schwab keeps one refresh token per app per login, so a second program's sign-in ends the first's. The Broker page and Help say plainly that the app key must be your own, never shared. The key, the secret and the tokens live in the Keychain / Credential Manager only, never in a file or a log. The callback is caught on this computer with a certificate made on the spot; pasting the address is the fallback. AlertDesk never trades: no order function is used.

Our own evidence

`tests/test_broker_schwab.py`, with Schwab's token service stood in for: sign-in, refresh, a refused refresh, 7 days running out, Disconnect wiping everything, the callback caught over https on 127.0.0.1, and no key, secret or token in the data folder, the log or a page. Tried live on 10/12/2026 with an app key another program also used: 34 minutes after AlertDesk signed in, Schwab refused the other program's refresh token ("invalid, expired or revoked"). Sharing an app key is ruled out.