To help you stay vigilant and protect your business and customers against fraud and cyberattacks, we’ve outlined some security best practices and suggested actions below.

1. Protect your API keys

  • Store Alpaca API keys in a secrets manager. Never hard-code them or embed them in client-side apps, mobile apps or browser code.
  • Never share keys in Slack, email, support tickets, docs or AI tools. If a key has ever been shared this way, rotate it.
  • Rotate keys on a regular schedule (no longer than 365 days) and immediately after any staff departure or suspected exposure.
  • Restrict access to Alpaca’s Broker API dashboard and APIs with IP allowlisting, and give each key only the permissions it needs.
  • Keep Sandbox and Production credentials fully separate.

2. Secure your team's access

  • Require MFA, preferably phishing-resistant MFA (hardware keys or passkeys), for every user of the Alpaca Broker API dashboard and your internal admin tools.
  • Periodically review who has access to Alpaca systems and remove anyone who no longer needs it.
  • Make sure laptops used by engineers and operations staff have endpoint protection, full-disk encryption and automatic updates enabled.
  • Limit who can access production systems, and require approvals for high-risk actions.

3. Watch for social engineering

  • Be suspicious of urgent requests by phone, email, text, or chat, including ones that appear to come from Alpaca, regulators, government agencies or your own executives.
  • Alpaca will never ask you for your API secret keys, passwords, or MFA codes.
  • Verify any request to change bank details, withdrawal instructions, or account ownership through a known, separate channel before acting.
  • Remind your support teams that attackers may keep agents on the phone for long periods or ask for remote access to their computer.

4. Review your third-party tools

  • Inventory the vendors, SDKs, analytics, and AI tools that touch customer data or your production environment, and limit the data you share with them.
  • Keep third-party software patched, and remove tools you no longer use.
  • Ask key vendors how they would notify you of an incident.

5. Maintain your own security safeguards

As an Alpaca partner, you are responsible for maintaining appropriate security safeguards across your applications, infrastructure, personnel, and customer-facing systems. Key practices include:

  • Secure your applications and infrastructure: Implement appropriate security controls across your applications, APIs, infrastructure, and systems that connect to Alpaca.
  • Test your security regularly: Conduct routine vulnerability assessments and independent penetration tests to identify and remediate potential weaknesses.
  • Train your employees: Provide regular security awareness training, including how to recognize phishing, social engineering, and AI-enabled impersonation attempts.
  • Maintain an incident response plan: Establish and regularly test procedures for identifying, containing, and responding to security incidents, including timely notification to Alpaca when relevant.
  • Review your cyber insurance coverage: Maintain appropriate cybersecurity insurance based on your business operations, risk exposure, and potential liabilities.

6. Monitor for unusual activity

  • Compare Alpaca's trade, transfer, and journal events against your own records. An order, withdrawal, or journal that your systems have no record of sending is the clearest sign that someone else is using your credentials.
  • Watch for unusual order patterns, such as sudden high-volume trading in the same low-priced security across multiple accounts.
  • Flag withdrawals to bank accounts that differ from the funding source, or rapid changes to account details followed by withdrawals.
  • Monitor new account onboarding for signs of synthetic or stolen identities.

7. Report suspected incidents promptly

If you suspect a compromise of your systems, credentials, or customer accounts, contact Alpaca right away at [email protected] and [email protected] even if you're not yet sure. Early notice lets us help you rotate credentials, apply temporary restrictions and protect your customers.