Everyone, the login issue after creating a new account has been resolved. If you were not able to log in, try again. Please post back if you are still having issues. Again, apologies for the inconvenience.
@Micah_Wright The problem you seem to be having is different. I see you created a separate post here and I’ll respond there.
I just created a new account, and I am having this same problem. I have gone through the authentication and received an email saying my brokerage account is approved and ready. But when I try to logon, I briefly see a logged in dashboard, but this immediately disappears and takes me back to the login screen. I have tried two browsers (Chrome and Safari), incognito mode, and clearing cookies. Nothing helps. I login and am immediately kicked back to the login screen.
I have had an account for a little while now, my trading api broke when attempting to download some forex data and when i try to log into my account I got stuck in this same endless loop of logging in, seeing my homepage, and then immediately being booted out again.
Same issue with my account login as well. Started yesterday late afternoon and continues. Please advise on possible fixes. I too have tried multiple devices, cleared history/cache, etc.
@Telcomac99 Currently, there is system maintenance going on. Check out the details here on the status page. That may be the issue in your case. However, the other posts were earlier, and the Alpaca engineering team is looking into the issue.
When looking at network logs, I’m getting a 401 to the paper trader upon successful login, and subsequently a 400 bad request to AWS cognito - So I’m assuming its an issue with the AWS authentication flow - just fyi.
I took the time to grab the HAR files from my login sessions and had Claude read through them with RCA in mind. Maybe would be helpful maybe not:
Summary: Every login to app.alpaca.markets succeeds, but I’m bounced back to the login screen
within ~1 second. HAR captures show the cause: a single API call returns 401 and the frontend
treats it as an expired session and force-logs me out.
DetailsfromHARcapture(2026-07-11,~14:54UTC):
Cognito authentication (InitiateAuth → RespondToAuthChallenge ×3 → GetUser), the
authx.alpaca.markets token exchange, and ~25 dashboard API calls (accounts, details, margin,
positions, orders, watchlists) all return 200.
Exactly one request fails:
GET /internal/paper_accounts/<paper_account_id>/portfolio/history?start=0001-01-01T00:00:00Z&period
=1D&intraday_reporting=continuous → 401 {“code”:401,“message”:“unauthorized”}
~100ms after the 401, the app calls Cognito RevokeToken and navigates away from the dashboard —
i.e., the frontend deliberately logs the session out in response to the 401. Reproduces on every
login. (Side effect: because the refresh token gets revoked on each forced logout, other
tabs/remembered sessions subsequently fail token refresh with a Cognito 400
NotAuthorizedException.)
WhatIruledout (by replaying requests with the same Bearer token from the capture):
Not a Cognito/login problem: every Cognito call in the capture returns 200.
Not an invalid/expired token: the failing request carries the byte-for-byte identical
Authorization header as the sibling requests that succeed, and the token was well within its
validity window.
Not clock skew / nbf: replaying the same request 3 minutes after token mint still returns 401.
Not the odd start=0001-01-01 parameter: minimal params (?period=1D) and a sane start date also
return 401.
Not account state in general: /positions, /orders, /trade_account/margin on the samepaper account with the same token all return 200.
Not the endpoint in general: the live account’s /internal/accounts//portfolio/history returns
200 with the same token.
Conclusion: The auth layer in front of /internal/paper_accounts//portfolio/history (which
appears to be a different gateway — its CORS headers advertise Apca-Api-Key-Id/Apca-Api-Secret-Key)
rejects a web-session token that every other dashboard endpoint accepts. The dashboard overview
requests that chart immediately on load, and the resulting 401 triggers the frontend’s global
session-expired handler, logging the user out.
Request IDs from the failing calls, in case Alpaca staff can look them up:
58976713d453db237553e200a2f5bf46 (2026-07-11 14:54:29 UTC) and d0bb00c643f720654d1234981dbb1a8a
(2026-07-11 14:44:56 UTC).
@Dan_Whitnable_Alpaca if I do the following block, using uBlock origin, my login persists and I don’t get logged back out, fyi:
Workaround: blocking that one request client-side (uBlock Origin filter
||app.alpaca.markets/internal/paper_accounts/*/portfolio/history$xhr) should prevent the 401 so the
session survives; the paper portfolio chart just doesn’t render.
I’m running into this issue as well, outside of scheduled maintenance windows. I fairly recently signed up, and it gives me hesitancy using this platform moving forward, especially seeing how this issue has been long-running
Is there any update about this from the Alpaca team? I can’t even withdraw funds if I needed to, it’s pretty concerning. I emailed support but have yet to receive a reply
Edit: Workaround posted by @Dave_F works for me as well
Same issue…bots can connect, but when logging into the website app.alpaca.markets/account/login I get a “Success! logging you in…” then it kicks me back to the login page.
Now I have page translated it to English and it says User Filter. That’s a rule so it could also be a User Rule or something like this. It should be User and one of these there. You will get an interpreter starting with “1”. There you paste what I gave above. It should work. You might have some cookie issues so consider to delete them
Edit: Consider removing the rule when 401 error is fixed