Alpaca mit deinem Trading-Bot verbinden

Why Alpaca

Alpaca is the canonical retail broker for algorithmic equity trading in the US. The same REST + WebSocket API serves both live trading and a paper sandbox with realistic fills, which means you can dry-run a Noon Barbari strategy for weeks before risking real capital. They also offer commission-free US crypto.

If you are outside the US, Alpaca is still useful as a paper-trading playground even if you cannot fund a live account.

Before you start

Sign up for free at alpaca.markets. For paper trading, no KYC is required. For live trading you must complete Alpaca's brokerage onboarding (SSN/ITIN for US persons, equivalent for international). Enable 2FA on your Alpaca dashboard as soon as you log in.

Alpaca splits live and paper into two distinct environments with two separate API keypairs. You cannot use a paper key against the live endpoint or vice versa.

Create the API key

1. Log in to app.alpaca.markets (live) or paper.alpaca.markets (paper).
2. In the dashboard sidebar, find the API Keys card on the home page.
3. Click Generate New Key. Alpaca shows the Key ID and Secret Key once.
4. Copy both immediately. The secret cannot be retrieved again — if you lose it, regenerate.

Repeat for the paper environment if you also want a paper key.

Set the right permissions

Alpaca's API keys grant full access to the environment they were created in. There is no granular permission picker as on Binance or Kraken; the trade-off is that Alpaca enforces a withdrawal whitelist on the account side rather than per-key.

• ✅ Live key — covers all live actions.
• ✅ Paper key — covers all paper actions; cannot move real money.
• ❌ Do not store the live key in any non-production environment.

For safety, set up a withdrawal address whitelist on the live account from Account → Banking → ACH withdrawal whitelist before issuing a live key.

IP whitelist

Alpaca does not offer per-key IP whitelisting in the retail dashboard. The mitigations are:

1. Keep the secret in a password manager, not in any source repo.
2. Run with the paper key during development, switch to the live key only on Noon Barbari's servers.
3. Lock down ACH/wire withdrawals on the account itself; Alpaca lets you require 2FA + 3-day delay for any new beneficiary.

If you need IP whitelisting, Alpaca's Broker API (white-label) supports it; the retail Trading API does not.

For reference, Noon Barbari's egress IP is 51.38.112.198.

51.38.112.198

Paste keys into Noon Barbari

When you save the credentials, the dashboard will ask whether the keypair is Paper or Live — pick the matching environment. Mixing them up returns immediate 401 errors but will not damage anything. Once the API key is created, copy the public key and the secret into Noon Barbari from the Profile → Exchange keys section of your account. Keys are encrypted at rest with a per-user envelope key and only decrypted in memory while a strategy run is active — they never leave the worker that needs them.

If the exchange issues a third value (passphrase, API memo, sub-account label), there will be a dedicated field for it. Save the form and the dashboard will run a lightweight balance query to confirm the credentials work.

Test the connection

Noon Barbari will issue a single read-only balance request the moment you save the key. A green tick means the credentials authenticated and your permission scopes match what the strategy needs. A red error usually points to one of four things: wrong key/secret pair, missing permission, IP whitelist mismatch, or 2FA grace period not yet expired.

Once green, run a small paper trade for a day before flipping a strategy to live. Real execution exposes you to fees, partial fills, and slippage that paper mode cannot replicate.

Security tips

Treat exchange API keys like SSH keys to a production server — rotate them on a schedule and revoke them the moment you no longer need them.

1. Never grant withdraw — Noon Barbari only needs read + trade. A key without withdraw cannot move funds out of your account, no matter who steals it.
2. Use a sub-account if your exchange supports them — isolates the bot's capital from your spot stack and your manual trading.
3. Enable IP whitelist even when the exchange does not require it.
4. Rotate keys every 90 days — set a calendar reminder. The exchange's UI will let you create a new key and revoke the old one in the same session.
5. Enable exchange-side alerts for new API keys, failed logins, and large orders so you find out about a compromise within minutes, not days.

Häufige Fallen

• Using the live URL with a paper key (or vice versa). Errors come back as a generic 401; double-check the environment dropdown in Noon Barbari.
• Forgetting that Alpaca crypto and Alpaca equities use the same key but different symbology (BTCUSD vs AAPL).
• Assuming paper fills are perfect — they include a randomized slippage model. The number is small but non-zero.
• Not regenerating the secret after a laptop loss. Alpaca cannot revoke individual sessions, only individual keys.

Fehlersuche

• 401 — unauthorized.

  Wrong environment or wrong key/secret. Confirm in the Alpaca dashboard whether you copied the paper or live keypair, and that Noon Barbari is configured for the same environment.

• 403 — forbidden after a long-running session.

  Alpaca rotates the underlying session token periodically; the SDK in Noon Barbari handles this transparently. If you see persistent 403s, regenerate the keypair and update the dashboard.

• My paper account has the wrong starting balance.

  Reset it from the Paper dashboard → Reset Paper Account. You can set the starting equity to any value between $1k and $1M.

• Can I trade options or futures through Alpaca?

  Alpaca added options for some account types in 2024; futures are not supported. Noon Barbari currently routes only Alpaca equities and crypto.