菜单
Schwab API integration patterns including dual OAuth2 authentication, token management, market data retrieval, and order execution. Use when working on Schwab auth, tokens, API calls, market data, order placement, or any code touching schwab_auth, DualSchwabAuth, run_dual_auth, or token refresh.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
OpenClaw/operator extension for Schwab trading workflows. Canonical Schwab architecture contract is .cursor/skills/schwab-api/SKILL.md. This file documents OpenClaw-specific tool usage and guardrail behavior.
Scaffold a cockpit dashboard panel end to end: a DTO-backed read endpoint (shared in core/ for local + SaaS parity), a frontend panel module with explicit freshness/error states, and provenance rendering. Use when adding or editing a cockpit lane/panel, an /api/cockpit/* route, core/cockpit_service builders, or any static/ panel that consumes ApiResponse data.
Consistent behavior under stale data, endpoint failures, and fallback use: data-quality labeling, provenance/confidence, circuit-breaker handling, and auto-throttle of risk-increasing orders. Use when working on data_health, fallback logic, circuit breakers, fail-closed risk gates, Provenance, or auto-throttle in execution policies.
Execution intelligence scaffolding: order lifecycle normalization, expected-vs- realized slippage, spread/latency/fill-quality attribution, and policy-driven routing (market vs limit, reprice loop, auto-throttle). Use when working on execution.py order routing, exec quality, slippage, reprice loops, core/execution_policies.py, ExecutionState/blotter, or /api/cockpit/execution/*.
Canonical Schwab endpoint map for the Trading Cockpit: which API surfaces exist, how they are classified (market context / symbol intel / portfolio risk / execution / reliability), their session, latency budgets, fallback rules, and degraded-mode behavior. Use when adding a Schwab endpoint, wiring a provider, defining a cockpit DTO, planning capability gaps, or touching core/endpoint_catalog.py, core/contracts/, or core/providers/.
Closed-loop learning: snapshot every trade decision into a decision packet, run weekly diagnostics (false positives by regime, edge decay by setup, execution drag by condition), and emit advisory tuning proposals for scanner weights and guardrail thresholds. Use when working on decision packets, trade review, outcome attribution, weight/threshold feedback, or core/decision_packet.py / trade_review.py / weight_feedback.py.
| name | schwab-api |
| description | Schwab API integration patterns including dual OAuth2 authentication, token management, market data retrieval, and order execution. Use when working on Schwab auth, tokens, API calls, market data, order placement, or any code touching schwab_auth, DualSchwabAuth, run_dual_auth, or token refresh. |
This is the canonical Schwab skill contract for TradingBot.
schwab_skill/SKILL.md and must
remain consistent with this canonical contract.The system uses two separate Schwab developer apps with distinct permissions:
| Session | Purpose | Env Prefix | Token File |
|---|---|---|---|
| Market | Quotes, chains, movers, price history | SCHWAB_MARKET_* | tokens_market.enc |
| Account | Positions, orders, account info | SCHWAB_ACCOUNT_* | tokens_account.enc |
Why two apps: Schwab's API requires different OAuth scopes. Splitting them isolates market data access from account-mutating operations.
SCHWAB_MARKET_APP_KEY=...
SCHWAB_MARKET_APP_SECRET=...
SCHWAB_ACCOUNT_APP_KEY=...
SCHWAB_ACCOUNT_APP_SECRET=...
SCHWAB_CALLBACK_URL=https://127.0.0.1:8182
SCHWAB_MARKET_CALLBACK_URL=https://127.0.0.1:8182 # optional, falls back to SCHWAB_CALLBACK_URL
SCHWAB_TOKEN_ENCRYPTION_KEY=... # optional, for encrypted token files
SaaS adds: CREDENTIAL_ENCRYPTION_KEY for per-user tokens stored in user_credentials table.
python run_dual_auth.py opens browser for both appsDualSchwabAuth auto-refreshes tokens on expiryGET /api/oauth/schwab/{account|market}/authorize-urlDualSchwabAuth created from DB credentialsDualSchwabAuth handles automatic refresh. If tokens expire completely:
run_dual_auth.pyPriority chain in market_data.py:
Circuit breaker trips after consecutive failures, auto-recovers after cooldown.
GET /api/health/deep — checks token validity, quote freshness, DB connectivitypython healthcheck.py — local CLI diagnosticmarket_token_ok, account_token_ok, last_quote_age_secschwab_skill/schwab_auth.py — DualSchwabAuth classschwab_skill/run_dual_auth.py — browser OAuth flowschwab_skill/market_data.py — data retrieval with fallbacksschwab_skill/execution.py — order placementschwab_skill/webapp/tenant_dashboard.py — SaaS OAuth callbacks