Alpaca

Alpaca OAuth API

The Alpaca OAuth API allows third-party applications to authenticate Alpaca users and obtain access tokens for the Trading and Market Data APIs.

Documentation GitHub OpenAPI

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/oauth-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.0.0
info:
  title: Broker Account Activities OAuth API
  description: Open brokerage accounts, enable crypto and stock trading, and manage the ongoing user experience with Alpaca Broker API
  version: 1.0.0
  contact:
    name: Alpaca Support
    email: support@alpaca.markets
    url: https://alpaca.markets/support
  termsOfService: https://s3.amazonaws.com/files.alpaca.markets/disclosures/library/TermsAndConditions.pdf
servers:
- url: https://broker-api.sandbox.alpaca.markets
  description: Sandbox endpoint
- url: https://broker-api.alpaca.markets
  description: Production endpoint
security:
- BasicAuth: []
tags:
- name: OAuth
paths:
  /v1/oauth/clients/{client_id}:
    parameters:
    - name: client_id
      required: true
      in: path
      schema:
        type: string
        format: uuid
    get:
      summary: Get an OAuth client
      tags:
      - OAuth
      description: 'The endpoint returns the details of OAuth client to display in the authorization page.

        '
      parameters:
      - name: response_type
        in: query
        schema:
          type: string
          enum:
          - code
          - token
          example: token
        description: code or token
      - name: redirect_uri
        in: query
        schema:
          type: string
          example: https://example.com/authorize
        description: Redirect URI of the OAuth flow
      - name: scope
        in: query
        schema:
          type: string
          example: general
        description: Requested scopes by the OAuth flow
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OathClientResponse'
              examples:
                example-1:
                  value:
                    client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
                    name: TradingApp
                    description: Sample description
                    url: http://test.com
                    terms_of_use: ''
                    privacy_policy: ''
                    status: ACTIVE
                    redirect_uri:
                    - http://localhost
                    live_trading_approved: false
        '401':
          description: 'Client does not exist or you do not have access to the client.

            '
          content:
            application/json:
              schema:
                type: string
      operationId: getOAuthClient
  /v1/oauth/token:
    post:
      summary: Issue an OAuth token.
      tags:
      - OAuth
      description: 'The operation issues an OAuth code which can be used in the OAuth code flow.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
      responses:
        '200':
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IssueOAuthTokenResponse'
              examples:
                example-1:
                  value:
                    access_token: 87586f14-c3f4-4912-b107-f75bc17ff87a
                    token_type: Bearer
                    scope: general
        '401':
          description: 'Client does not exists, you do not have access to the client, or “client_secret” is incorrect.

            '
          content:
            application/json:
              schema:
                type: string
        '422':
          description: 'Redirect URI or scope is invalid.

            '
          content:
            application/json:
              schema:
                type: string
      operationId: issueOAuthToken
  /v1/oauth/authorize:
    post:
      summary: Authorize an OAuth Token
      tags:
      - OAuth
      description: 'The operation issues an OAuth code which can be used in the OAuth code flow.

        '
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
      responses:
        '200':
          description: Successfully issued a code.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthorizeOAuthTokenResponse'
        '401':
          description: 'Client does not exists, you do not have access to the client, or “client_secret” is incorrect.

            '
          content:
            application/json:
              schema:
                type: string
        '422':
          description: 'Redirect URI or scope is invalid.

            '
          content:
            application/json:
              schema:
                type: string
      operationId: authorizeOAuthToken
components:
  schemas:
    IssueOAuthTokenResponse:
      description: ''
      type: object
      x-examples:
        example-1:
          access_token: 87586f14-c3f4-4912-b107-f75bc17ff87a
          token_type: Bearer
          scope: general
      properties:
        access_token:
          type: string
          description: OAuth token
        token_type:
          type: string
          description: Always `Bearer`
          enum:
          - Bearer
          example: Bearer
        scope:
          type: string
          description: Token’s scope
      required:
      - access_token
      - token_type
      - scope
    AuthorizeOAuthTokenResponse:
      description: ''
      type: object
      x-examples:
        example-1:
          code: 912b5502-c983-40f7-a01d-6a66f13a754d
          client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
          redirect_uri: http://localhost
          scope: ''
      properties:
        code:
          type: string
          minLength: 1
          description: OAuth code to exchange with token
        client_id:
          type: string
          minLength: 1
          description: OAuth `client_id`
        redirect_uri:
          type: string
          minLength: 1
          description: Redirect URI of OAuth flow
        scope:
          type: string
          description: Granted scopes
      required:
      - code
      - client_id
      - redirect_uri
      - scope
    OathClientResponse:
      title: OathClientResponse
      type: object
      example:
        client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
        name: TradingApp
        description: Sample description
        url: http://test.com
        terms_of_use: ''
        privacy_policy: ''
        status: ACTIVE
        redirect_uri:
        - http://localhost
        live_trading_approved: true
      x-examples:
        example-1:
          client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
          name: TradingApp
          description: Sample description
          url: http://test.com
          terms_of_use: ''
          privacy_policy: ''
          status: ACTIVE
          redirect_uri:
          - http://localhost
          live_trading_approved: true
      properties:
        client_id:
          type: string
          description: OAuth client id
        name:
          type: string
          description: Broker name (your name)
        description:
          type: string
        url:
          type: string
        terms_of_use:
          type: string
          description: URL of Terms of Use
        privacy_policy:
          type: string
          description: URL of Privacy Policy
        status:
          type: string
          enum:
          - ACTIVE
          - DISABLED
          description: ACTIVE or DISABLED
          example: ACTIVE
        redirect_uri:
          type: array
          items:
            type: string
        live_trading_approved:
          type: boolean
          example: true
    OAuthTokenRequest:
      title: OAuthTokenRequest
      type: object
      example:
        client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
        client_secret: bbb14da2b6b8e7117a3c52a910e1dc2a
        redirect_uri: http://localhost
        scope: general
        account_id: 0d18ae51-3c94-4511-b209-101e1666416b
      properties:
        client_id:
          type: string
          description: OAuth client ID
        client_secret:
          type: string
          description: OAuth client secret
        redirect_uri:
          type: string
          description: redirect URI for the OAuth flow
        scope:
          type: string
          description: scopes requested by the OAuth flow
        account_id:
          type: string
          format: uuid
          description: end-user account ID
      required:
      - client_id
      - client_secret
      - redirect_uri
      - scope
      - account_id
      description: This model is used for both the Issue and Authorize OAuth token routes
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic