Robinhood API

Before writing any code, make an informed architectural decision. Robinhood's Terms of Service, specifically the restrictions on automated platform access, prohibit third-party apps from calling their internal endpoints. The unofficial endpoint at https://api.robinhood.com/oauth2/token/ issues a session/bearer token that works today but has broken before when Robinhood updated their mobile apps. Accounts detected using automated access have been suspended — this is a real user account with real money, not a sandbox environment. The recommended alternative for any user-facing product is Plaid (https://plaid.com). Plaid's Investments product officially aggregates brokerage data from Robinhood and dozens of other brokerages. Users authenticate through Plaid Link, a hosted UI widget that Robinhood officially supports. The API is documented, versioned, and stable — it will not silently break overnight. Plaid has a free Sandbox environment you can use today without a paid account. If after reading all of this you are proceeding with the unofficial Robinhood endpoints for a personal project, proceed to Step 2. Keep your usage strictly personal, never ask other users to enter their Robinhood credentials into your app, and build the Plaid path in parallel so you have a fallback ready when the unofficial endpoints inevitably change. Consider whether the integration is worth the maintenance burden before investing significant build time.

The session token from Robinhood's login endpoint grants full brokerage account access. It must never appear inside a FlutterFlow API Call header, an App Value, or Dart custom action code — all of these compile into the app bundle and can be extracted from a decompiled APK. Instead, deploy a Firebase Cloud Function that performs the Robinhood authentication and stores the session token in Firestore, accessible only to the function. In your Firebase project (Blaze plan required for Cloud Functions), create a new function in Node.js 18. The login function accepts a trigger from your FlutterFlow app and POSTs the Robinhood credentials to https://api.robinhood.com/oauth2/token/ using the same client_id and grant_type=password payload that Robinhood's mobile apps use. Store the returned access_token and refresh_token in a Firestore document, encrypted at rest by Google. Keep your Robinhood username and password in Firebase Functions config environment variables (not hardcoded in the function file): firebase functions:config:set robinhood.username='...' robinhood.password='...'. Create a second function, GetPositions, that reads the stored access_token from Firestore and forwards it as a Bearer Authorization header when calling https://api.robinhood.com/positions/?nonzero=true. If the call returns 401, attempt a token refresh using the stored refresh_token before surfacing an error to the app. This two-function pattern — Login and GetPositions — is the minimum viable proxy. Add additional proxy endpoints for /portfolios/ or /quotes/ as your app needs them, all following the same pattern: read token from Firestore, call Robinhood, return the data.

1// Firebase Cloud Function proxy — index.js
2// Run: firebase deploy --only functions
3const functions = require('firebase-functions');
4const admin = require('firebase-admin');
5const axios = require('axios');
6admin.initializeApp();
7
8// Login function: stores session token in Firestore
9exports.robinhoodLogin = functions.https.onCall(async (data, context) => {
10  const cfg = functions.config().robinhood;
11  const resp = await axios.post('https://api.robinhood.com/oauth2/token/', {
12    username: cfg.username,
13    password: cfg.password,
14    grant_type: 'password',
15    // Robinhood's well-known public client_id used by their mobile apps
16    client_id: 'c82SH0WZOsabOXGP2sxqcj34FxkvfnWRZBKlBjFS',
17    scope: 'internal',
18    expires_in: 86400,
19    device_token: data.deviceToken || 'flutter-proxy-device',
20  });
21  const { access_token, refresh_token } = resp.data;
22  await admin.firestore().doc('robinhood/session').set({
23    access_token,
24    refresh_token,
25    updated: Date.now(),
26  });
27  return { ok: true };
28});
29
30// GetPositions: reads token, calls Robinhood, returns positions
31exports.robinhoodPositions = functions.https.onCall(async (data, context) => {
32  const doc = await admin.firestore().doc('robinhood/session').get();
33  if (!doc.exists) {
34    throw new functions.https.HttpsError('unauthenticated', 'No session — call login first.');
35  }
36  const { access_token } = doc.data();
37  try {
38    const resp = await axios.get(
39      'https://api.robinhood.com/positions/?nonzero=true',
40      { headers: { Authorization: `Bearer ${access_token}` } }
41    );
42    return { results: resp.data.results };
43  } catch (err) {
44    if (err.response?.status === 401) {
45      throw new functions.https.HttpsError('unauthenticated', 'Token expired. Re-login required.');
46    }
47    throw err;
48  }
49});

With the proxy running, set up the FlutterFlow side. Open your project and click API Calls in the left navigation panel. Click the blue + Add button, then select Create API Group. Name the group RobinhoodProxy. For the Base URL, enter the base URL of your Firebase Functions project: https://us-central1-YOUR-PROJECT-ID.cloudfunctions.net. You are pointing FlutterFlow at your proxy, not at api.robinhood.com. Inside the group, click + Add API Call. Name the call GetPositions. Set the method to POST (Firebase callable functions use POST) and the path to /robinhoodPositions. In the Body tab, set the content type to JSON and add the body: {}. If you are using Firebase Auth to protect your function, add an Authorization header in the Headers tab with value Bearer {{authToken}} and create the authToken variable in the Variables tab — this would be the Firebase Auth ID token from your logged-in FlutterFlow user. Switch to the Response & Test tab. Paste a sample response JSON in the body field (see the code block below), then click Generate JSON Paths. FlutterFlow will automatically create paths like $.results[0].quantity and $.results[0].average_buy_price. Create a FlutterFlow Data Type called StockPosition with fields: quantity (String), averageBuyPrice (String), instrumentUrl (String). Map the generated JSON paths to this Data Type. Click Test API Call to verify a live 200 response from your proxy before moving to the UI.

1// Paste this sample in the FlutterFlow Response & Test tab
2{
3  "results": [
4    {
5      "instrument": "https://api.robinhood.com/instruments/450dfc6d-5510-4d40-abfb-f633b7d9be3e/",
6      "quantity": "5.00000",
7      "average_buy_price": "145.23",
8      "intraday_quantity": "0.00000",
9      "updated_at": "2025-01-15T10:30:00Z"
10    }
11  ]
12}

Add a new Screen and name it Portfolio. In the widget tree, add a ListView widget. Select it, open the Backend Query panel, choose API Call as the data source, select RobinhoodProxy → GetPositions, and set the List Type to StockPosition. FlutterFlow will automatically call your proxy when this screen loads and populate the list. Inside the ListView item template, add a Container for card styling with rounded corners (border radius 12, shadow enabled). Inside the Container, add a Column with two Rows. The first Row contains a Text widget for the ticker (bound to your position's instrumentUrl — note that Robinhood returns instrument URLs rather than ticker symbols directly; for a quick build, store a small static mapping in App State to resolve common tickers). The second Row contains a Text widget for quantity (bound to $.results[].quantity) and a Text widget for average buy price (bound to $.results[].averageBuyPrice). For the header of the screen, add a Text widget showing 'My Portfolio' and a subtitle showing the total number of positions. Bind the subtitle to the length of your StockPosition list (available via the List Count property in FlutterFlow's binding panel). Add a CircularProgressIndicator widget that shows while the backend query is loading — set its Visibility to only show when the API Call status is Loading. To display current market value rather than just average buy price, you need a second proxy endpoint that calls Robinhood's /quotes/?instruments=... with the instrument URLs. Add a second API Call in your group called GetQuotes with the instruments list as a query variable, call it from a Periodic Action, and store the current prices in a second App State list that you combine with positions for display.

With no Robinhood webhooks available, your app must poll the proxy to get fresh data. FlutterFlow supports this via a Periodic Action on a screen. Select the Portfolio screen in the widget tree, open the Actions panel in the right sidebar, and look for the Periodic Action trigger. Set it to fire every 300,000 milliseconds (5 minutes). Inside the Periodic Action, add a Backend/API Call action pointing to GetPositions and update the App State variable holding your positions list with the refreshed data. Also add an On Page Load action that calls GetPositions immediately when the screen opens — this ensures the user sees data right away without waiting up to 5 minutes for the first poll. The On Page Load and the Periodic Action both trigger the same GetPositions call. Five minutes is the minimum recommended polling interval for calls originating from a single Cloud Function IP. More frequent polling risks triggering Robinhood's IP-based rate limiting, which can block your entire Cloud Function outbound IP range — blocking all app sessions simultaneously. If your app might have multiple simultaneous users triggering the proxy, increase the interval to 10 minutes. Add error handling to the Periodic Action: chain a Conditional Action after GetPositions that checks if the API response status code is not 200 or 201. If an error is returned, update an App State Boolean called hasRefreshError to true. Add a small error banner widget to the Portfolio screen that is only visible when hasRefreshError is true, showing 'Portfolio data may be stale — pull down to retry.' This gives users clear feedback without breaking the entire screen.

Unofficial Robinhood endpoints fail in two distinct ways: token expiry (returns 401) and silent endpoint changes (returns 404 or an unexpected response shape). Your proxy should handle each differently. For 401 token expiry, add refresh logic in your Cloud Function: when GetPositions receives a 401 from Robinhood, the function automatically POSTs to /oauth2/token/ with grant_type=refresh_token and the stored refresh_token. If the refresh succeeds, the function updates Firestore with the new tokens and retries the original request transparently. If the refresh also fails (the token has been fully revoked), the function returns a JSON body like {"error": "session_expired"} to FlutterFlow. In FlutterFlow, add a Conditional Action on the GetPositions error path: check if the error response contains 'session_expired' and, if so, navigate to a Reconnect screen that explains the session has ended and prompts re-authentication (which calls your Login proxy endpoint again). For endpoint changes — the more insidious failure — add a Conditional Action that checks whether the returned results array is null or empty when you expected data. Show a 'Service temporarily unavailable' message. In your proxy, log all unexpected response shapes to a Firestore errors collection with timestamp and full response body so you can diagnose changes quickly. Consider a Cloud Scheduler job that pings the positions endpoint every hour and sends an alert if the response shape changes — you want to know about endpoint breakage before your users do. If building and maintaining all of this proxy and monitoring infrastructure sounds like a lot, RapidDev's team handles FlutterFlow integrations like this every week — free scoping call at rapidevelopers.com/contact.