Tradovate uses OAuth: Tradeus sends you to Tradovate, you log in there, and the token that comes back is stored encrypted against your connection. There is no password field, and nothing to rotate here when you change your Tradovate password.
Tradovate runs two separate deployments, and neither can see the other's accounts. Prop firm and evaluation money is simulated and lives on one; money you funded yourself lives on the other. You are not asked which you have — after you approve, Tradeus looks on both.
What comes back
Accounts on one side
One connection, marked
Demo or Live. That mark is the difference between simulated prop firm money and real cash, so it is not cosmetic.Accounts on both
Two connections, one of each. Tradovate treats them as different logins and so does Tradeus.
Accounts on neither
Nothing is stored, and the message names what each side answered. Usually the login was a personal one and the prop firm issued its own.
Authorization expires
OAuth tokens do not last forever. When one lapses the connection shows
Authorization expired with a Re-authorize button. Nothing routes while it says that.