Robinhood API

Before touching Bubble, make an informed decision about which path you're taking. Here are your two options: **Option A — Plaid (recommended):** Sign up at dashboard.plaid.com, create an application, and get your client_id and sandbox secret. Plaid's Link widget handles the OAuth flow to connect Robinhood (and other brokerages) on behalf of your users. After linking, you call GET /investments/holdings with your plaid-client-id and plaid-secret headers (server-side, both Private in Bubble's API Connector). Plaid returns security names, tickers, quantities, and values in a well-documented JSON format. Rate limits are documented, support is available, and there is zero ToS risk. The main trade-off is that Plaid's production tier requires business approval and carries per-call costs — the sandbox is free and unlimited for development. **Option B — Unofficial Robinhood (understand the risks):** Using the unofficial endpoints at https://api.robinhood.com works today. But Robinhood's Terms of Service section 3 prohibits automated access through scripts. Your account can be suspended without warning. Robinhood has banned the third-party client_id that was historically used for OAuth. If you are building an app where end users connect their own Robinhood accounts, those users are exposed to the same risk. We are documenting this path for educational purposes — not recommending it for production apps. If you are building for users beyond yourself, use Plaid. If you are building a personal tool and accept the risk, continue to Step 2.

1// Plaid Investment Holdings API (recommended)
2// Headers for all Plaid data calls:
3{
4  "PLAID-CLIENT-ID": "<your_client_id>",  // Private in Bubble API Connector
5  "PLAID-SECRET": "<your_sandbox_secret>",  // Private in Bubble API Connector
6  "Content-Type": "application/json"
7}
8
9// POST /investments/holdings
10// Body:
11{
12  "client_id": "<your_client_id>",
13  "secret": "<your_sandbox_secret>",
14  "access_token": "<user_plaid_access_token>"
15}

In your Bubble editor, click on the **Plugins** tab in the left sidebar. If you do not already have API Connector installed, click **Add plugins**, search for 'API Connector', find the one labeled 'API Connector by Bubble' and click Install. Once installed, click API Connector in your plugins list to open its configuration panel. Click **Add another API** to create a new API group. Name it 'Robinhood' (or 'Plaid' if using that path). Set the authentication type to 'None or self-handled' — you will manage the bearer token manually in the header. In the **Shared headers** section of the API group (not on individual calls), click the + to add a header. Set the header name to `Authorization`. Set the value to `Bearer <access_token>` where `<access_token>` is a parameter placeholder you will fill at call time. Critically, tick the **Private** checkbox on this header. The Private checkbox tells Bubble's API Connector to substitute this value server-side and never expose it in browser network requests. Without Private, the token appears in your app's client-side JavaScript. Set the base URL for the API group to `https://api.robinhood.com`. Click Save.

1// API Connector configuration (conceptual)
2{
3  "api_name": "Robinhood",
4  "base_url": "https://api.robinhood.com",
5  "shared_headers": [
6    {
7      "name": "Authorization",
8      "value": "Bearer <access_token>",
9      "private": true
10    }
11  ]
12}

The API Connector requires a successful Initialize Call before you can use any API call in your Bubble workflows. This means you need to provide a real access token to test with during configuration. To get a test access token from the unofficial Robinhood API, you need to perform the OAuth2 token request manually using Postman or your browser. The token endpoint is `POST https://api.robinhood.com/oauth2/token/`. The request body must include your Robinhood username, password, and Robinhood's own app client_id. Important: the client_id for the Robinhood mobile app is a hardcoded value — using it to authenticate means you are technically impersonating Robinhood's own client application, which is part of why this is a Terms of Service violation. Once you have a valid bearer token (the token field from the OAuth2 response), return to your Bubble API Connector. Inside the Robinhood API group, click **Add a call**. Set the call name to 'Get User Info'. Set the method to GET and the path to `/user/`. In the test value field for the `access_token` parameter, paste your real bearer token. Click **Initialize call**. If the token is valid, you will see a 200 response with user account information including username, email, and account details. Bubble will auto-detect the response fields, making them available to use in workflows and page bindings. Click **Save**. If you get a 401 error, the token has expired (they last 24 hours) or was entered incorrectly. If you get an MFA challenge response, the Initialize Call cannot proceed interactively — see the troubleshooting section for MFA handling.

1// Initialize Call configuration
2{
3  "call_name": "Get User Info",
4  "method": "GET",
5  "path": "/user/",
6  "use_as": "Data",
7  "headers": {
8    "Authorization": "Bearer <access_token>"  // Private, from shared header
9  }
10}
11
12// Expected successful response shape:
13{
14  "username": "jsmith",
15  "first_name": "John",
16  "last_name": "Smith",
17  "email": "jsmith@example.com",
18  "id": "abc123-def456-..."
19}

Inside your Robinhood API group, click **Add a call** to add a positions call. Name it 'Get Positions', method GET, path `/positions/`. Initialize this call with your test token. The response is a paginated `results` array — each item contains fields like `quantity`, `average_buy_price`, and `instrument` (a URL string like `https://api.robinhood.com/instruments/abc123/`). This is the most important gotcha with the unofficial Robinhood API: the positions endpoint does NOT return ticker symbols or company names. It returns instrument URL strings. To get the ticker (e.g. AAPL, TSLA), you must make a second API call to that instrument URL for each position. This means one position in your portfolio = two API calls. For a portfolio with 20 positions, that is 40 API calls. At Bubble's Workload Unit (WU) pricing, these add up fast. To handle this, add a second call named 'Get Instrument Detail', method GET, path `/instruments/[instrument_id]/`. The path parameter `[instrument_id]` will be the UUID extracted from the instrument URL. In your Bubble workflow, when iterating through positions, call this endpoint for each position to retrieve `symbol` and `simple_name` fields, then use those to populate your display. Also add a 'Get Portfolios' call: GET `/portfolios/`. This returns the total portfolio value in `equity` and `extended_hours_equity` fields — useful for the portfolio summary display. In your Bubble page, create a Repeating Group bound to the 'Get Positions' data. For each row, trigger a 'When page is loaded' workflow that calls 'Get Instrument Detail' for that row's instrument ID and saves the ticker to the database to avoid re-fetching.

1// GET /positions/ — response shape (simplified)
2{
3  "next": null,
4  "previous": null,
5  "results": [
6    {
7      "quantity": "10.00000",
8      "average_buy_price": "142.50000",
9      "instrument": "https://api.robinhood.com/instruments/450dfc6d-5510-4d40-abfb-f633b7d9be3e/",
10      "account": "https://api.robinhood.com/accounts/AB1234/"
11    }
12  ]
13}
14
15// GET /instruments/{id}/ — response shape
16{
17  "symbol": "AAPL",
18  "simple_name": "Apple",
19  "name": "Apple Inc. Common Stock",
20  "tradeable": true,
21  "type": "stock"
22}
23
24// GET /portfolios/ — response shape
25{
26  "equity": "14523.45",
27  "extended_hours_equity": "14489.12",
28  "market_value": "14123.00"
29}

The unofficial Robinhood access token expires in approximately 24 hours. Once it expires, every API call will return 401 until a new token is obtained. If your Bubble app is for personal use only, you may be able to manually refresh the token once a day. For any multi-user or automated setup, you need a token refresh Backend Workflow — which requires a paid Bubble plan (Starter or higher). First, token storage. In the Bubble Data tab, add a field to your User data type: `robinhood_token` (text), `robinhood_token_issued_at` (date). After successfully authenticating outside Bubble and obtaining a token, store it in the User record. When API calls are made, the workflow reads `Current User's robinhood_token` and uses it as the `access_token` parameter. For token expiry detection, in any workflow that calls a Robinhood API, add a first step: check if `Current User's robinhood_token_issued_at` is more than 23 hours ago. If yes, trigger the 'Refresh Robinhood Token' Backend Workflow before the API call. However, re-authentication in the unofficial Robinhood API is not a simple refresh token exchange. The unofficial endpoint does not provide long-lived refresh tokens in the same way as standard OAuth. For automated refresh, you need to store the user's Robinhood username and password in Bubble's database — which is a significant security risk and is not recommended. For most use cases, plan for users to re-authenticate manually once per day. Privacy rules are critical: in the Data tab, click Privacy, select your User type, and add a rule: 'This User is Current User' → allow field robinhood_token to be read only by the user themselves. Without this rule, any user of your app could potentially read another user's token field through data queries.

1// Bubble Data type: User (additional fields)
2{
3  "robinhood_token": "text",
4  "robinhood_token_issued_at": "date"
5}
6
7// Workflow logic for token age check:
8// Condition: Current User's robinhood_token_issued_at < Current date/time - 23 hours
9// Action: Show "Please re-authenticate" popup
10
11// Privacy Rule (Data tab → Privacy → User):
12// Rule: When This User is Current User
13// Allow access to field: robinhood_token (read only for the token owner)

With your API calls configured and tokens stored, build the portfolio display in your Bubble page editor. Drag a **Repeating Group** onto your page. In the Type of content, set it to match your cached positions data type (if using a database caching approach) or set it to 'Robinhood → Get Positions' (the API call result) for live fetching. Set the Data source to 'Get data from an external API' → Robinhood - Get Positions → Results. Set a list constraint or fixed count to avoid runaway WU consumption on large portfolios. Inside the Repeating Group, add text elements for the position data you want to display. For the ticker symbol: if you are using cached database records, reference `Current cell's Instrument's symbol`. For the quantity: `Current cell's quantity` (format as number). For average buy price: `Current cell's average_buy_price` (format as currency). Add a separate section above the Repeating Group for portfolio summary. Use a text element bound to 'Get data from an external API → Robinhood - Get Portfolios → equity', formatted as currency. This shows the total portfolio value. For the instrument URL resolution: add a workflow 'When page is loaded → Schedule API Workflow on a list' (paid plan) to batch-resolve all instrument URLs and save tickers to your database. This runs once on each page load but only writes to the database when the instrument is not already cached. All subsequent visits read from the database cache instead of calling the Robinhood instrument endpoint per row. RapidDev's team has built Bubble apps integrating financial APIs of this complexity — if you want a scoping call to review your architecture before building, visit rapidevelopers.com/contact.

1// Repeating Group data source configuration:
2// Type of content: Robinhood Position (database type, if caching)
3// Data source: Do a search for Robinhood Positions where User = Current User
4
5// OR live API (higher WU cost):
6// Data source: Get data from external API → Robinhood - Get Positions → results
7
8// Text element binding examples:
9// Ticker: Current cell's instrument_symbol  (from cached database)
10// Qty: Current cell's quantity formatted as number (decimal: 2)
11// Avg price: Current cell's average_buy_price formatted as currency
12// Total value: Current cell's quantity * Current cell's current_price (if stored)
13
14// Portfolio total text:
15// Get data from external API → Robinhood - Get Portfolios → equity
16// formatted as currency