skills.rest
asarchami
asarchamiCOMMUNITY
Explore all skills by this author →
GitHub

alpaca-connect

Implements OAuth2 authorization flows for apps accessing Alpaca brokerage accounts.

1|2|Updated Nov 25, 2017
Search Tags:#fintech#oauth2#trading api#alpaca#token refresh#authorization flow
One-click install
npx skills add https://github.com/asarchami/dotfiles --skill alpaca-connect-asarchami
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: alpaca-connect
Source: https://github.com/asarchami/dotfiles/tree/main/dot_config/opencode/skills/alpaca/connect
Command: npx skills add https://github.com/asarchami/dotfiles --skill alpaca-connect-asarchami

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Building a third-party trading app that acts on behalf of Alpaca users requires correctly implementing the OAuth2 authorization code flow, token exchange, refresh logic, and scope management against Alpaca's Connect API, which is error-prone without a reference. ## Core Features & Use Cases - OAuth2 Flow Guidance: Covers app registration, the authorization request, code exchange, bearer token usage, and refresh token rotation with Go code examples. - Scope and Security Reference: Documents available scopes (account:read, trading:read, trading:write, data:read) and security practices like state validation, token storage, and private_key_jwt client authentication. - Use Case: You are building a fintech app that places trades for users. Use this Skill to implement the full authorize → token exchange → API call → token refresh lifecycle against Alpaca's paper and live endpoints. ## Quick Start Help me implement the Alpaca Connect OAuth2 authorization code flow for my trading app, including token exchange and refresh handling.

Frequently Asked Questions about alpaca-connect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement OAuth2 with the Alpaca Connect API?▼

Register your app in the Alpaca Dashboard to get a client_id and client_secret, redirect users to the authorization endpoint with response_type=code, then exchange the returned code at the token endpoint for access and refresh tokens.

How to refresh an expired Alpaca OAuth access token?▼

Send a POST request to the token endpoint with grant_type=refresh_token, your refresh_token, client_id, and client_secret. The response returns a new access token and a new refresh token, so implement token rotation.

What scopes does the Alpaca Connect API support?▼

Alpaca Connect supports account:read, trading:read, trading:write, and data:read scopes. Request only the minimum scopes your app needs, since excessive scope requests can reduce user trust and approval rates.

Can I test the Alpaca OAuth flow without real money?▼

Yes, use the paper trading endpoints at paper-api.alpaca.markets for both token exchange and API calls. Users can authorize with their paper trading accounts, while live trading requires Alpaca Compliance approval.

What are the limitations of Alpaca Connect OAuth2?▼

OAuth2 is only available for the Trading API, not the Broker API, and broker partners must build their own OAuth service. Access tokens expire within hours, and rate limits apply per user rather than per app.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

testing-oauth2-implementation-flaws

Tests OAuth 2.0 and OpenID Connect implementations for redirect, PKCE, and token flaws.

Community
Advanced
alpacahqalpacahq
108

alpaca-trading-example

Automate Alpaca trading operations including orders, positions, and market data.

Official
Intermediate
chroniicallydiistractedchroniicallydiistracted

better-auth-security-best-practices

Configure Better Auth secrets, rate limiting, CSRF, sessions, and OAuth token encryption.

Community
Advanced
alpacahqalpacahq
108

alpaca-broker-trading-orders

Automate order placement, management, and tracking for Alpaca Broker API accounts.

Official
Intermediate