SoarSoar
Return to dashboard
Broker setup

Connect Alpaca

Paper trading available5 steps2 fields

Alpaca keys cannot move money out of your account — by design. Practice keys and real-money keys are separate; pick the right mode before generating.

Step by step

Getting your Alpaca API keys

  1. 1
    Open Alpaca and sign in
    New here? Sign up for free — practice mode needs no funding or ID check.
  2. 2
    Switch to the right mode
    In the top-left, flip the account switch to:
    • PAPER — practice (free, no funding needed)
    • LIVE — real money (requires ID verification first)
  3. 3
    Find the "Your API Keys" box
    Look on the right side on desktop, or near the bottom on mobile.
  4. 4
    Tap "Generate New Key"
    Alpaca shows two values — a Key ID and a Secret — in a one-time confirmation panel.
  5. 5
    Copy both right away
    The Secret is shown ONCE. If you lose it, you have to generate a new pair — which breaks any bot already using the old one.
Permissions

What to enable — and what to leave OFF

✓Enable these
  • Trading (the only thing Alpaca keys can do)
✕Never enable these
  • (Alpaca keys can never move money out — withdrawals only happen through the dashboard)
Why this matters: Soar only ever needs read + place-order permissions. If you give a key withdraw or transfer access, anyone with that key could move funds — including a security risk if your machine is ever compromised. Disabling withdraw on the key itself means even a worst-case leak can't drain your account.
What you paste

The fields Soar asks for

  • API Key ID
    paste Key ID
    Visible in the "Your API Keys" panel on your Alpaca dashboard.
  • API Secret
    paste secret here
    Only shown ONCE at generation. If lost, you have to regenerate.
Security & trust

Where your keys live

Soar passes your Alpacakeys straight from your browser into YOUR Cloudflare Worker. Soar's servers see them once during the ~30-second deploy window, then never again.

The bot that talks to Alpaca runs on the free Cloudflare Workers tier in your own Cloudflare account. You see + control everything from your Cloudflare dashboard. You can rotate the keys, pause the bot, or destroy the Worker at any time — Soar has zero ability to undo that.

Read the full security model
See also

Related help topics