Alpaca OAuth API
The Alpaca OAuth API allows third-party applications to authenticate Alpaca users and obtain access tokens for the Trading and Market Data APIs.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/oauth-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Broker O Auth API
description: Open brokerage accounts, enable crypto and stock trading, and manage the ongoing user experience with Alpaca Broker API
version: 1.0.0
contact:
name: Alpaca Support
email: support@alpaca.markets
url: https://alpaca.markets/support
termsOfService: https://s3.amazonaws.com/files.alpaca.markets/disclosures/library/TermsAndConditions.pdf
servers:
- url: https://broker-api.sandbox.alpaca.markets
description: Sandbox endpoint
- url: https://broker-api.alpaca.markets
description: Production endpoint
security:
- BasicAuth: []
tags:
- name: OAuth
paths:
/v1/oauth/clients/{client_id}:
parameters:
- name: client_id
required: true
in: path
schema:
type: string
format: uuid
get:
summary: Get an OAuth client
tags:
- OAuth
description: 'The endpoint returns the details of OAuth client to display in the authorization page.
'
parameters:
- name: response_type
in: query
schema:
type: string
enum:
- code
- token
example: token
description: code or token
- name: redirect_uri
in: query
schema:
type: string
example: https://example.com/authorize
description: Redirect URI of the OAuth flow
- name: scope
in: query
schema:
type: string
example: general
description: Requested scopes by the OAuth flow
responses:
'200':
description: Success.
content:
application/json:
schema:
$ref: '#/components/schemas/OathClientResponse'
examples:
example-1:
value:
client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
name: TradingApp
description: Sample description
url: http://test.com
terms_of_use: ''
privacy_policy: ''
status: ACTIVE
redirect_uri:
- http://localhost
live_trading_approved: false
'401':
description: 'Client does not exist or you do not have access to the client.
'
content:
application/json:
schema:
type: string
operationId: getOAuthClient
/v1/oauth/token:
post:
summary: Issue an OAuth token.
tags:
- OAuth
description: 'The operation issues an OAuth code which can be used in the OAuth code flow.
'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthTokenRequest'
responses:
'200':
description: Success.
content:
application/json:
schema:
$ref: '#/components/schemas/IssueOAuthTokenResponse'
examples:
example-1:
value:
access_token: 87586f14-c3f4-4912-b107-f75bc17ff87a
token_type: Bearer
scope: general
'401':
description: 'Client does not exists, you do not have access to the client, or “client_secret” is incorrect.
'
content:
application/json:
schema:
type: string
'422':
description: 'Redirect URI or scope is invalid.
'
content:
application/json:
schema:
type: string
operationId: issueOAuthToken
/v1/oauth/authorize:
post:
summary: Authorize an OAuth Token
tags:
- OAuth
description: 'The operation issues an OAuth code which can be used in the OAuth code flow.
'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthTokenRequest'
responses:
'200':
description: Successfully issued a code.
content:
application/json:
schema:
$ref: '#/components/schemas/AuthorizeOAuthTokenResponse'
'401':
description: 'Client does not exists, you do not have access to the client, or “client_secret” is incorrect.
'
content:
application/json:
schema:
type: string
'422':
description: 'Redirect URI or scope is invalid.
'
content:
application/json:
schema:
type: string
operationId: authorizeOAuthToken
components:
schemas:
AuthorizeOAuthTokenResponse:
description: ''
type: object
x-examples:
example-1:
code: 912b5502-c983-40f7-a01d-6a66f13a754d
client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
redirect_uri: http://localhost
scope: ''
properties:
code:
type: string
minLength: 1
description: OAuth code to exchange with token
client_id:
type: string
minLength: 1
description: OAuth `client_id`
redirect_uri:
type: string
minLength: 1
description: Redirect URI of OAuth flow
scope:
type: string
description: Granted scopes
required:
- code
- client_id
- redirect_uri
- scope
IssueOAuthTokenResponse:
description: ''
type: object
x-examples:
example-1:
access_token: 87586f14-c3f4-4912-b107-f75bc17ff87a
token_type: Bearer
scope: general
properties:
access_token:
type: string
description: OAuth token
token_type:
type: string
description: Always `Bearer`
enum:
- Bearer
example: Bearer
scope:
type: string
description: Token’s scope
required:
- access_token
- token_type
- scope
OathClientResponse:
title: OathClientResponse
type: object
example:
client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
name: TradingApp
description: Sample description
url: http://test.com
terms_of_use: ''
privacy_policy: ''
status: ACTIVE
redirect_uri:
- http://localhost
live_trading_approved: true
x-examples:
example-1:
client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
name: TradingApp
description: Sample description
url: http://test.com
terms_of_use: ''
privacy_policy: ''
status: ACTIVE
redirect_uri:
- http://localhost
live_trading_approved: true
properties:
client_id:
type: string
description: OAuth client id
name:
type: string
description: Broker name (your name)
description:
type: string
url:
type: string
terms_of_use:
type: string
description: URL of Terms of Use
privacy_policy:
type: string
description: URL of Privacy Policy
status:
type: string
enum:
- ACTIVE
- DISABLED
description: ACTIVE or DISABLED
example: ACTIVE
redirect_uri:
type: array
items:
type: string
live_trading_approved:
type: boolean
example: true
OAuthTokenRequest:
title: OAuthTokenRequest
type: object
example:
client_id: 7a3c52a910e1dc2abbb14da2b6b8e711
client_secret: bbb14da2b6b8e7117a3c52a910e1dc2a
redirect_uri: http://localhost
scope: general
account_id: 0d18ae51-3c94-4511-b209-101e1666416b
properties:
client_id:
type: string
description: OAuth client ID
client_secret:
type: string
description: OAuth client secret
redirect_uri:
type: string
description: redirect URI for the OAuth flow
scope:
type: string
description: scopes requested by the OAuth flow
account_id:
type: string
format: uuid
description: end-user account ID
required:
- client_id
- client_secret
- redirect_uri
- scope
- account_id
description: This model is used for both the Issue and Authorize OAuth token routes
securitySchemes:
BasicAuth:
type: http
scheme: basic