Hello,
I’m building an automated trading system and I won’t feel comfortable connecting a live cash account until IP allowlisting is available on API keys. An algo trading key has full order submission permissions — if it’s ever leaked, there’s nothing stopping it from being used from anywhere in the world.
The fix is standard: major brokerage API and cloud provider offers IP-based key restrictions. For an automated system connecting from a fixed machine, there’s no reason the key should accept requests from the entire internet.
Notably, the allowlist field already exists in the Alpaca dashboard — it’s just disabled at the account level. Enabling it (even via a support request initially) would meaningfully close this gap and make live deployment a realistic option for security-conscious algo traders.
Thank you!
Best wishes.