Broker & API setup for AI trading.
Every retail-accessible broker worth naming for automated share trading in 2026 — with 2026 auth patterns, paper environments, market-data pricing and the setup steps a builder actually follows.
Choice of broker is the single decision that most constrains what an AI trading system can and cannot do. It fixes the auth pattern, the paper environment, the shape of order events, whether market data is a subscription or a bundled benefit, and — through market-data licensing — whether backtested strategies can even be shared. The seven brokers below cover the practical space for retail builders in 2026. The order is by API quality and retail accessibility, not by size.
Section IInteractive Brokers
Interactive Brokers remains the reference broker for retail algo and AI builders. Instrument breadth (135 markets, 33 currencies), universal UK / EU / US retail eligibility, and two distinct API surfaces make it the default choice when the strategy needs to reach anything beyond US equities.
Two APIs, different jobs
The TWS API is the classic socket API. It requires Trader Workstation or the headless IB Gateway running locally (or on a co-located VPS) and listens on ports 7496 (live) and 7497 (paper) for TWS, or 4001/4002 for IB Gateway. Bindings exist for Python, Java, C++ and C#/.NET.
The Client Portal Web API is REST plus WebSocket over HTTPS. The 2025-2026 shift is that IBKR is consolidating this, Digital Account Management and the Flex Web Service into a unified IBKR Web API with OAuth 2.0 authentication (private_key_jwt, a JWT client_assertion signed with keys registered at onboarding). Retail self-service now offers OAuth 2.0 alongside legacy OAuth 1.0a and the Java Client Portal Gateway.
The legacy Client Portal Gateway path still works: run the JVM locally, hit https://localhost:5000/v1/api/, log in via browser (two-factor authentication is mandatory), then call /iserver/auth/ssodh/init. Sessions expire after roughly six minutes idle — you must poll /tickle every five minutes. Full session lifetime is around 24 hours and resets at midnight New York, Zug or Hong Kong time.
When to use which
TWS API for low-latency loops, complex order types and the full historical bar surface — most builders pair it with the ib_async library. Web API for cloud or serverless AI agents where you don’t want to babysit a JVM, or for account-management flows.
Paper trading
Free, unlimited, $1M in virtual equity. Enable in Client Portal → Settings → Account Settings → Paper Trading Account. Separate DU… credentials are issued. Faster alternatives: IBKR GlobalTrader (simulated $10k, no KYC, delayed data) and the free trial ($1M, delayed).
Market data
Non-consolidated Cboe One and IEX real-time data is free on US stocks and ETFs. Free ten-to-fifteen minute delayed data is available via reqMarketDataType(3) on most instruments. Consolidated NYSE, NASDAQ and LSE feeds are paid subscriptions per exchange, waived if monthly commissions exceed $5 (or $15 for premium bundles).
Rate limits
TWS API: 50 messages per second default. Historical data pacing is the most-hit constraint: no identical request within 15 seconds; at most 6 same-tuple requests per 2 seconds; at most 60 requests per 10 minutes; at most 50 concurrent. The Web API is more lenient per-endpoint, but the /tickle keepalive is the classic gotcha.
Lite vs Pro
IBKR Lite is commission-free on US stocks and ETFs with payment-for-order-flow routing, and is restricted to US and Singapore residents. IBKR Pro uses Fixed or Tiered commissions with SmartRouting and is universally available, including through IBKR UK and IBKR Ireland (the post-Brexit EU entity).
Setup flow
- Open the residency-appropriate entity.
- Fund (no minimum on cash accounts).
- Client Portal → Settings → API → enable API and Paper Trading.
- Download TWS or IB Gateway (or register OAuth 2.0 keys).
- In TWS: Global Config → API → Settings → enable ActiveX and Socket Clients.
- First call:
ib.connect('127.0.0.1', 7497, clientId=1).
Section IIAlpaca
Alpaca is the default US commission-free API broker for algo and AI builders. Its 2025-2026 story is jurisdictional expansion and options depth.
Product and eligibility
US stocks and ETFs (commission-free), options Levels 1 through 3 (Level 3 multi-leg went live in early 2025), and crypto (over 20 assets and 56 pairs). Non-US retail expanded to 195-plus countries through Alpaca Securities LLC on a non-solicited basis; Canada is excluded. KYC uses local tax identifier plus photo and address. Accounts are USD-only, funded via Rapyd.
Surface
Live REST is at api.alpaca.markets; paper at paper-api.alpaca.markets. Market data REST at data.alpaca.markets. WebSocket streams live at wss://stream.data.alpaca.markets/v2/{iex|sip|delayed_sip} for stocks, with separate crypto and options streams. Order events come through the trade_updates channel on the trading WebSocket. JSON or MessagePack, with per-RFC-7692 compression.
Auth
API key and secret in headers APCA-API-KEY-ID and APCA-API-SECRET-KEY. OAuth 2.0 exists for third-party apps connecting existing Alpaca users. The Broker API is a separate correspondent-clearing offering — not what an individual algo builder wants.
Paper trading
Free, unlimited, no funding, no Social Security number required. Separate keys from the dashboard’s Paper tab. Set APCA_API_BASE_URL=https://paper-api.alpaca.markets.
Market data (2026)
- Basic (free): real-time IEX for stocks, 15-minute delayed SIP via REST, indicative options feed.
- Algo Trader Plus: $99 per month — full CTA and UTP SIP real-time equities, full OPRA options, 10,000 requests per minute, seven-plus years of history.
- Elite tier bundles Algo Trader Plus free for personal use.
Rate limits
Trading API: 200 requests per minute per account default. Market data REST: 200 rpm on Basic, up to 10,000 rpm on Algo Trader Plus.
Setup
Sign up at app.alpaca.markets. Paper keys are issued instantly. Live requires either a Social Security number (US residents) or a foreign tax identifier plus the Non-Solicitation Agreement. From the dashboard, generate API keys and confirm connectivity:
curl -H "APCA-API-KEY-ID: …" \
-H "APCA-API-SECRET-KEY: …" \
https://paper-api.alpaca.markets/v2/accountSDK: the official alpaca-py, currently v0.43.5 (2 July 2026). The legacy alpaca-trade-api has been deprecated since end 2022.
Section IIICharles Schwab (post-TD Ameritrade)
The TD Ameritrade API endpoints were disabled after market close on 10 May 2024. The tda-api library is end-of-life. Its replacement is the Schwab Individual Trader API at developer.schwab.com. TDA developer apps did not carry over; re-registration is required.
Access
Requires a Schwab retail brokerage account. Register at developer.schwab.com, request the Trader API — Individual product tile; app status transitions from “Approved – Pending” to “Ready to Use.” Approval time varies from days to a month. Non-US retail eligibility is not clearly stated in Schwab’s public materials as of publication.
Auth
OAuth 2.0 authorization_code. Access token TTL is 30 minutes. Refresh token TTL is 7 days — hard. There is no extension mechanism; a bot offline for more than seven days forces full re-consent. This remains the single biggest complaint about the API. Libraries such as schwab-py roll the seven-day window as long as the process runs.
Endpoints
Trader API (accounts — indexed by hash, not raw account number — orders, transactions, preferences). Market Data API (quotes, price history, options chains, movers, market hours).
Rate limits
120 requests per minute per account on order writes and market data. Errors 429-001 for steady rate and 429-005 for burst; roughly 60 seconds of back-off is recommended.
Market data
Real-time equities and options quotes plus full options chains are bundled free with a funded Schwab account.
Paper trading: none
thinkorswim paperMoney is not API-exposed. Schwab’s Sandbox is only for OAuth wiring, not realistic execution simulation. A community stopgap exists at Patch-Code-Prosperity/Schwab-API-Sandbox but is a mock server, not a fill simulator.
Section IVE*TRADE
Still live for retail post the Morgan Stanley acquisition; no deprecation notice has been published at developer.etrade.com. Persistent community rumours of eventual consolidation into a broader Morgan Stanley developer platform remain unconfirmed.
Auth: OAuth 1.0a three-legged (HMAC-SHA1). Sandbox and Production use separate consumer keys; the sandbox key is self-serve; the production key is issued via secure-message request.
Market data: real-time after signing the market-data agreement; otherwise delayed.
Rate limits: per-module throttling (Accounts, Market, Order) — combined per-second plus per-hour caps. Specific limits are not published; the Get Rate Limits endpoint returns the current window. The sandbox does not return valid option chains. Library: pyetrade, currently v2.1.0 (April 2024).
Section VUK / EU retail — the 2026 shift
Two long-standing “no API” holdouts changed course during 2025-2026.
Trading 212
Launched an official Public API (beta) at docs.trading212.com/api. Environments: demo.trading212.com/api/v0 (paper) and live.trading212.com/api/v0. API-key auth generated in-app. Coverage is Invest and Stocks ISA only — no CFD. The live environment currently restricts orders to Market-type only during beta; a real constraint for algorithmic strategies that need limits or stops. Community wrapper: bennycode/trading212-api.
eToro
Now runs api-portal.etoro.com and builders.etoro.com covering market data, portfolio, orders (with stop-loss and take-profit), and social-trading endpoints. An official eToro MCP server launched in March 2026; the OpenAPI specification advanced from v1.206 to v1.244 through June 2026.
Saxo Bank OpenAPI
Remains the deepest UK / EU retail-accessible surface. REST plus streaming, OAuth 2.0 (Authorization Code with PKCE for public clients). The SIM environment mirrors live with $100k in demo funds; SIM lacks full market data and reporting. Non-FX market data is exchange-fee pass-through.
What’s not on the list
Freetrade has no retail trading API. Revolut’s stock trading is UI-only; developer.revolut.com exposes the Business API and the crypto Revolut X REST API. DEGIRO has no official API; only community reverse-engineered libraries, which are terms-of-service grey.
Section VINewer entrants worth flagging
Public.com
Shipped a real Trading API at public.com/api/docs covering stocks, ETFs, options, index options, crypto, bonds and treasuries. Free (commission-free equities, options rebates). Official Python SDK. The Public MCP server launched in March 2026. Recent changelog: stop-limit equity orders (21 May 2026), multi-brokerage-account support (20 May 2026).
Tradier
docs.tradier.com — REST plus WebSocket, OAuth 2.0 bearer tokens, free paper sandbox. Real-time equities and options data are included with Tradier Brokerage after a two-month intro, then $10 per month for Pro or $35 per month for Pro Plus. Rate limit is approximately 120 requests per minute. Options chain with Greeks. Options commission $0.35 per contract.
Tastytrade
developer.tastytrade.com. REST plus DXLink streaming quotes and account-events WebSocket. OAuth 2.0 is now standard (session token 15-minute TTL; refresh tokens long-lived). Certification (paper) environment at api.cert.tastyworks.com. Market data included with funded live accounts. Two Python SDKs: official tastytrade-sdk (v1.2.0) and the more active community tastyware/tastytrade.
Kraken US equities
Went live in 2026 through Kraken Securities LLC (FINRA / SIPC), commission-free on 11,000+ US stocks and ETFs, with a phased state rollout. No public equities API has surfaced yet as of mid-2026; currently UI-only via Kraken Desktop. The separate xStocks tokenised-equity product is non-US only. The crypto API surface is unchanged and mature.
Robinhood
Still no official equities or options API in 2026. docs.robinhood.com covers only the Crypto Trading API (EdDSA-signed REST). Equity automation still means robin_stocks against private mobile endpoints — terms-of-service grey and prone to breaking on backend changes. The SEC settled a $45M enforcement against Robinhood on 13 January 2025 for recordkeeping and AML failings.
IBKR ForecastEx
The only prediction-market surface with a real programmatic API, exposed through the standard TWS API. On 14 May 2026 IBKR launched a unified prediction-markets interface covering Kalshi, CME event contracts and ForecastEx at $0.01 per contract.
Section VIIAuth patterns at a glance
| Pattern | Brokers | Notes |
|---|---|---|
| API key + secret in headers | Alpaca, Trading 212, Kraken (crypto) | Simplest — key maps to user, no consent flow. |
| OAuth 2.0 (Auth Code) | Schwab, Saxo, IBKR Web API (new), eToro, Tradier, Tastytrade, Public.com | Standard for retail-user-owned data. Watch refresh-token TTL — Schwab’s 7-day cap is the harshest in the field. |
| OAuth 1.0a | E*TRADE, IBKR Web API (legacy vendor path) | HMAC-SHA1 signing; parameter-order pedantic. |
| Session token (local gateway) | IBKR CP Gateway (legacy), Tastytrade legacy | Requires 2FA browser step. /tickle keepalive mandatory. |
| Socket API on local process | IBKR TWS API | Not “auth” per se — the running gateway holds credentials. |
Section VIIIStatus changes affecting builders (2024-2026)
- TDA API sunset: 10 May 2024. Schwab Individual Trader API is the replacement.
- SEC Rule 605 amendments adopted 6 March 2024 — first substantive revision since 2000. Compliance date extended from 14 December 2025 to 1 August 2026.
- MiFID II / UK divergence: EU MiFID III deleted the RTS 28 top-five-venue reports and suspended RTS 27 for two years. UK FCA is consulting on removing both entirely.
- EU AI Act: retail personal-trading AI is not classified high-risk under Annex III as of 2026. GPAI obligations from 2 August 2025; Article 6 from 2 August 2026.
- Consolidated Audit Trail (CAT): February 2025 CAIS Amendment proposes dropping name, address and year-of-birth from PII reporting. No new obligations for retail API providers.
Editor’s note
Every price, rate limit and auth mechanism above was pulled from primary sources in July 2026. Before making commercial decisions, re-verify: (i) IBKR’s market-data pricing schedule; (ii) Trading 212’s live-order type restriction (that beta constraint is the item most likely to move next); (iii) Schwab’s non-US eligibility position.