Alpaca wants to remind you to stay vigilant against phishing, fraud, and other cybersecurity threats. With AI making these attacks increasingly sophisticated and harder to detect, protecting your Alpaca account and API credentials is more important than ever.

Here are a few security best practices to help keep your account and trading activity secure:

• Turn on MFA for your Alpaca account if you haven't already.
• Keep your API keys private. Don't paste them into public code repositories, chats, forums or AI tools. If you think a key has been exposed, regenerate it from your dashboard right away.
• Be wary of messages asking for your login details or keys. Alpaca will never ask for your password, MFA codes or API secret keys.
• Check before you click. Go directly to alpaca.markets rather than following links in unexpected emails or texts.
• Keep your devices updated, and only use trusted networks when logging in.

If you notice anything unusual on your account, contact us at [email protected].

Additional security resources:

• Guide to Multi-Factor Authentication (MFA) & Account Security for Alpaca Builders
• API Key Security Best Practices For Alpaca Builders