Alpaca

Alpaca O Auth API

The OAuth API from Alpaca — 3 operation(s) for oauth.

GitHub OpenAPI
Business capability
Developer Identity & Credential Management BC-4270.40

Operations 3

POST /v1/oauth/authorize Authorize an OAuth Token #
GET /v1/oauth/clients/{client_id} Get an OAuth client #
POST /v1/oauth/token Issue an OAuth token #

Documentation

📖
Documentation
https://docs.alpaca.markets/docs/using-oauth2-and-trading-api

Specifications

⚙
OpenAPI
https://artifacts.apis.io/alpaca/openapi/alpaca-oauth-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/alpaca/json-schema/alpaca-oath-client-response-schema.json
📊
JSONSchema
https://artifacts.apis.io/alpaca/json-schema/alpaca-oauth-token-request-schema.json
📊
JSONSchema
https://artifacts.apis.io/alpaca/json-schema/alpaca-authorize-oauth-token-response-schema.json
📊
JSONSchema
https://artifacts.apis.io/alpaca/json-schema/alpaca-issue-oauth-token-response-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/alpaca:alpaca-oauth-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

alpaca-oauth-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    email: support@alpaca.markets
    name: Alpaca Support
    url: https://alpaca.markets/support
  description: Open brokerage accounts, enable stock, options and crypto trading. Manage the ongoing user experience and brokerage customer lifecycle with the Alpaca Broker API
  termsOfService: https://s3.amazonaws.com/files.alpaca.markets/disclosures/library/TermsAndConditions.pdf
  title: Broker OAuth API
  version: 1.1.1
servers:
- description: Sandbox endpoint
  url: https://broker-api.sandbox.alpaca.markets
- description: Production endpoint
  url: https://broker-api.alpaca.markets
security:
- BasicAuth: []
tags:
- name: OAuth
paths:
  /v1/oauth/authorize:
    post:
      description: The operation issues an OAuth code which can be used in the OAuth code flow.
      operationId: authorizeOAuthToken
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizeOAuthTokenResponse'
          description: Successfully issued a code.
        '401':
          content:
            application/json:
              schema:
                type: string
          description: 'Client does not exist, you do not have access to the client, or "client_secret" is incorrect.

            '
        '422':
          content:
            application/json:
              schema:
                type: string
          description: 'Redirect URI or scope is invalid.

            '
      summary: Authorize an OAuth Token
      tags:
      - OAuth
  /v1/oauth/clients/{client_id}:
    parameters:
    - in: path
      name: client_id
      required: true
      schema:
        format: uuid
        type: string
    get:
      description: The endpoint returns the details of OAuth client to display in the authorization page.
      operationId: getOAuthClient
      parameters:
      - description: code or token
        in: query
        name: response_type
        schema:
          enum:
          - code
          - token
          example: token
          type: string
      - description: Redirect URI of the OAuth flow
        in: query
        name: redirect_uri
        schema:
          example: https://example.com/authorize
          type: string
      - description: Requested scopes by the OAuth flow
        in: query
        name: scope
        schema:
          example: general
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                example-1:
                  value:
                    client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
                    description: Sample description
                    live_trading_approved: false
                    name: TradingApp
                    privacy_policy: ''
                    redirect_uri:
                    - http://localhost
                    status: ACTIVE
                    terms_of_use: ''
                    url: http://test.com
              schema:
                $ref: '#/components/schemas/OathClientResponse'
          description: Success.
        '401':
          content:
            application/json:
              schema:
                type: string
          description: 'Client does not exist or you do not have access to the client.

            '
      summary: Get an OAuth client
      tags:
      - OAuth
  /v1/oauth/token:
    post:
      description: The operation issues an OAuth code which can be used in the OAuth code flow.
      operationId: issueOAuthToken
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example-1:
                  value:
                    access_token: 87586f14-c3f4-4912-b107-f75bc17ff87a
                    scope: general
                    token_type: Bearer
              schema:
                $ref: '#/components/schemas/IssueOAuthTokenResponse'
          description: Success.
        '401':
          content:
            application/json:
              schema:
                type: string
          description: 'Client does not exist, you do not have access to the client, or "client_secret" is incorrect.

            '
        '422':
          content:
            application/json:
              schema:
                type: string
          description: 'Redirect URI or scope is invalid.

            '
      summary: Issue an OAuth token
      tags:
      - OAuth
components:
  schemas:
    OAuthTokenRequest:
      description: This model is used for both the Issue and Authorize OAuth token routes
      example:
        account_id: 0d18ae51-3c94-4511-b209-101e1666416b
        client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
        client_secret: bbb14da2b6b8e7117a3c52a910e1dc2a
        redirect_uri: http://localhost
        scope: general
      properties:
        account_id:
          description: end-user account ID
          format: uuid
          type: string
        client_id:
          description: OAuth client ID
          type: string
        client_secret:
          description: OAuth client secret
          type: string
        redirect_uri:
          description: redirect URI for the OAuth flow
          type: string
        scope:
          description: scopes requested by the OAuth flow
          type: string
      required:
      - client_id
      - client_secret
      - redirect_uri
      - scope
      - account_id
      title: OAuthTokenRequest
      type: object
    AuthorizeOAuthTokenResponse:
      description: ''
      examples:
      - client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
        code: 912b5502-c983-40f7-a01d-6a66f13a754d
        redirect_uri: http://localhost
        scope: ''
      properties:
        client_id:
          description: OAuth `client_id`
          minLength: 1
          type: string
        code:
          description: OAuth code to exchange with token
          minLength: 1
          type: string
        redirect_uri:
          description: Redirect URI of OAuth flow
          minLength: 1
          type: string
        scope:
          description: Granted scopes
          type: string
      required:
      - code
      - client_id
      - redirect_uri
      - scope
      type: object
    IssueOAuthTokenResponse:
      description: ''
      examples:
      - access_token: 87586f14-c3f4-4912-b107-f75bc17ff87a
        scope: general
        token_type: Bearer
      properties:
        access_token:
          description: OAuth token
          type: string
        scope:
          description: Token's scope
          type: string
        token_type:
          description: Always `Bearer`
          enum:
          - Bearer
          example: Bearer
          type: string
      required:
      - access_token
      - token_type
      - scope
      type: object
    OathClientResponse:
      example:
        client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
        description: Sample description
        live_trading_approved: true
        name: TradingApp
        privacy_policy: ''
        redirect_uri:
        - http://localhost
        status: ACTIVE
        terms_of_use: ''
        url: http://test.com
      examples:
      - client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
        description: Sample description
        live_trading_approved: true
        name: TradingApp
        privacy_policy: ''
        redirect_uri:
        - http://localhost
        status: ACTIVE
        terms_of_use: ''
        url: http://test.com
      properties:
        client_id:
          description: OAuth client id
          type: string
        description:
          type: string
        live_trading_approved:
          example: true
          type: boolean
        name:
          description: Broker name (your name)
          type: string
        privacy_policy:
          description: URL of Privacy Policy
          type: string
        redirect_uri:
          items:
            type: string
          type: array
        status:
          description: ACTIVE or DISABLED
          enum:
          - ACTIVE
          - DISABLED
          example: ACTIVE
          type: string
        terms_of_use:
          description: URL of Terms of Use
          type: string
        url:
          type: string
      title: OathClientResponse
      type: object
  securitySchemes:
    BasicAuth:
      scheme: basic
      type: http
x-readme:
  explorer-enabled: true
  proxy-enabled: false