Skip to content

Authentication

Login, logout, token refresh, and session management.

pyhood.auth.login(username=None, password=None, mfa_code=None, timeout=60, store_session=True, token_path=None, expires_in=86400)

Log in to Robinhood.

Parameters:

Name Type Description Default
username str | None

Robinhood email/username.

None
password str | None

Robinhood password.

None
mfa_code str | None

MFA code if required (SMS/email/TOTP).

None
timeout float

Max seconds to wait for login (including device approval). Set to 0 to disable timeout. Default: 60s.

60
store_session bool

Cache tokens to disk for reuse. Default: True.

True
token_path Path | str | None

Custom path for token storage. Default: ~/.pyhood/session.json.

None
expires_in int

Token lifetime in seconds. Default: 86400 (24h).

86400

Returns:

Type Description
Session

Authenticated Session object.

Raises:

Type Description
LoginTimeout

Login hung (likely device approval timeout).

DeviceApprovalRequired

Robinhood wants app approval.

MFARequired

Need to provide mfa_code.

TokenExpired

Stored token expired, re-login needed.

AuthError

Generic auth failure.

pyhood.auth.refresh(token_path=None, timeout=30)

Refresh the session using the stored refresh token.

This avoids a full re-login and does NOT require device approval. The refresh token is exchanged for a new access_token + refresh_token pair.

Parameters:

Name Type Description Default
token_path Path | str | None

Custom path for token storage. Default: ~/.pyhood/session.json.

None
timeout float

Max seconds to wait. Default: 30s.

30

Returns:

Type Description
Session

Authenticated Session object with new tokens.

Raises:

Type Description
AuthError

No stored session or refresh token.

TokenExpired

Refresh token has expired (full re-login needed).

pyhood.auth.logout()

Log out and clear stored session.

pyhood.auth.get_session()

Get the active authenticated session. Raises if not logged in.

pyhood.auth.TokenStore

Manages token persistence on disk.

Stored data: - access_token, token_type, refresh_token: OAuth tokens - device_token: Persistent device ID (reuse avoids re-verification) - saved_at: Timestamp when tokens were saved

device_token property

Get the stored device token without loading full session.

load()

Load stored tokens. Returns None if no file or corrupt.

save(access_token, token_type, refresh_token, device_token)

Save tokens to disk.

clear()

Remove stored tokens.