OAuth2 Token Helper
The naive version of "call an OAuth2-protected API from an EA" either re-requests a token on every single call - burning the token endpoint's own rate limit for nothing - or fetches one token and caches it forever, letting every request start failing with 401 the moment it actually expires. This header issues the real RFC 6749 grants. OthFetchClientCredentialsToken() POSTs a client_credentials grant (form-urlencoded, per the RFC - not JSON); OthRefreshAccessToken() POSTs a refresh_token grant using whatever refresh token the server issued, when it issued one. OthGetAccessToken() is the entry point most callers actually want: it checks whether the cached access_token is missing or within OTH_DEFAULT_REFRESH_BUFFER_SEC (60s) of its real expiry - read from the response's own expires_in field, not guessed - and only then fetches a new one, preferring a cheap refresh_token grant over a full re-authentication whenever a refresh token is on hand. A request made right at the expiry boundary is refreshed proactively rather than racing a 401. The token response is parsed with a small flat-JSON field reader built for the RFC 6749 shape specifically (access_token, token_type, expires_in, refresh_token - all top-level, no nesting), not a general JSON library. Notes and limitations - WebRequest() only reaches hosts the terminal has explicitly whitelisted; every call fails with error 4060 until the token endpoint's host is added under Tools -> Options -> Expert Advisors. - OthTokenState holds the access/refresh token in plain memory for the life of the EA/script - MQL4 has no secure credential store. Treat the client_secret and any cached token the same way you would treat a plain-text password. - expires_in is trusted as returned by the server; a server that omits it gets a conservative 3600-second (1 hour) assumption rather than treating the token as never expiring. - This is the client-credentials and refresh-token grants only, the two that make sense for a headless EA/script with no user present. Authorization-code (the browser-redirect flow used for "log in with X") is out of scope - it fundamentally needs a human in a browser, which a terminal script cannot provide.
Script · MT5 · v1.0 · Free
About OAuth2 Token Helper
OAuth2 Token Helper is a script for MetaTrader 5. It has 3 settings, such as Token url, Client id and Client secret. MQL source code included.
Files in the download: OauthTokenHelper.mq5.mqh, OauthTokenHelper.txt, OauthTokenHelperDemo.ex5, OauthTokenHelperDemo.mq5.
Settings
| Setting | Default | What it does |
|---|---|---|
| Token url | paste a real, whitelisted OAuth2 token endpoint to test a live fetch (blank to skip) | |
| Client id | client_id for the live test | |
| Client secret | client_secret for the live test |
How to install
- Download the ZIP from your PolyMaria library and unzip it.
- In MetaTrader 5 open File → Open Data Folder, then go to MQL5 → Scripts.
- Copy the .mq5 file(s) there. Put any .mqh files in MQL5 → Include.
- Open the .mq5 file in MetaEditor and press Compile (F7) if MetaTrader does not show it.
- Drag the script onto a chart to run it once.
Tags: MT5 Script · MQL5 Source Code