same issue here. I’ve had my account for two months now. Just tried to log in as normal, logged in successfully and then got sent back to the login page again. endless loop
This worked immediately. Thanks
Im having the same issue. Login is fine and everything else is fine, but every time I press the home tab the page pulls up and I am taken to login screen only after my account details are loaded.
Same issue: I’m able to log in, but then I am immediately logged out. Not a good first impression
I’m having similar issue. I’m not a first time user, but when I login, go through 2FA, I see the home screen for a second and gets logged out immediately. I tried on my phone, different computer, and on private browser, none of them worked.
Login is broken. I log into the dashboard and get bounced straight back to /account/login with no session established, no session cookie is set. Reproduces in a clean incognito session, so it’s not client-side state. Could someone check whether anything shipped to the auth layer recently (Friday night)? If a recent change correlates, it may be worth considering a revert until a longer term fix is in place.
Suggestion: a browser based synthetic login check (full end-to-end from a clean browser, not just an endpoint ping) would likely catch this class of issue early, since the auth endpoint can return 200 while the session silently fails to persist.
Glad it worked! Don’t forget to remove the rule when everything is fixed
Alpaca login flasing dashboard then logging out
Alpaca Account Troubleshooting
Alpaca login flasing dashboard then logging out
Alpaca Account Troubleshooting
post by Chris_Bates 26 mins ago
So using a chrome browser from my mac, I am no longer able to log into the alpaca trading dashboard, was working fine for weeks, now logs in, I see the dashboard for a second, and then logs out. I used claude to debug and here are the findings
That’s the smoking gun. Here’s the full sequence the userscript caught:
You log in → it goes to the dashboard (/dashboard/overview genuinely loads at 18:21:52) → the dashboard fires two authenticated API calls → both come back 401 {"code":401,"message":"unauthorized"} → and ~0.1s later it bounces you to /account/login. So the login itself succeeds and mints a token, but Alpaca’s backend rejects that token with 401 when the dashboard tries to use it.
That’s why nothing browser-side fixed it — the handshake works; the server is refusing the authorization. Let me pull the exact endpoint that’s 401’ing (stripping the query string so the tool will show it).
Used claude-in-chrome integration
Used claude-in-chrome integration
Now it’s precise. The failing call is:
GET app.alpaca.markets/internal/paper_accounts/**58946c69-3597-4f17-8c1f-ad9995da7a15**/portfolio/history → 401 unauthorized
This is a paper trading account. Your dashboard loads, tries to pull the portfolio history for that specific paper account, gets a 401, and the app treats that single 401 as a session failure and logs you out — hence the loop. It’s not your browser and not your credentials; it’s that one paper account’s data being rejected. Let me look at the rest of the requests in that dashboard load to see what succeeded (like the accounts list) so we can tell whether that paper account is stale/orphaned versus a broader server issue.
Used claude-in-chrome integration
Used claude-in-chrome integration
Got it — this fully explains it, and it’s not your browser, your credentials, or anything you can fix by clearing data. Here’s the proof, from that same dashboard load:
The login and token are completely healthy — Cognito and authx.alpaca.markets/v1/oauth2/token all returned 200. And your token is authorized for the paper account (58946c69…): on that same account, in the same split second, these all succeeded —
…/paper_accounts/58946c69…/positions→ 200…/paper_accounts/58946c69…/orders→ 200…/paper_accounts/58946c69…/trade_account/margin→ 200authx…/paper-accounts/58946c69…/client-credentials→ 200
Only one endpoint failed:
…/paper_accounts/58946c69…/portfolio/history→ 401 (and it retried once — you can even see Alpaca fire token-refresh calls to Cognito at 52.6–52.7s trying to recover — still 401).
So a single Alpaca endpoint, portfolio/history, is returning 401 while every sibling endpoint on the same account with the same token returns 200. That’s a server-side bug on Alpaca’s portfolio-history service — not an auth problem. The reason it logs you out is that Alpaca’s dashboard has an over-aggressive global handler: any 401 → “session expired” → refresh-and-retry → still 401 → dump you back to login. One flaky endpoint is nuking your whole session.
What this means:
- You can’t fix this from your side — it’s Alpaca’s. Worth checking status.alpaca.markets and reporting it to Alpaca support with this exact evidence (portfolio/history 401 while positions/orders/margin return 200 for the same paper account). That’s a precise, hard-to-argue bug report.
If you want into the dashboard in the meantime, I can extend the Tampermonkey script to intercept that one broken portfolio/history response and hand the app a harmless empty result instead of the 401 — that stops the logout trigger and lets the dashboard load (the portfolio-history chart would just be blank until Alpaca fixes their end). Want me to build that workaround? Otherwise, disable the debug script for now and I’ll note this so we can revisit.
I am having same issue here i try using different browsers and still same error you log in, it shows the dashboard and imediatly logs you out and back to the login credentials webpage again.. this needs to be resolved
Here is a fix that lets you in using Chrome until they fix it. You will need the TamperMonkey Chrome plugin. Works for me; this most likely broke during their maintenance update. Hopefully someone from Alpaca is reading the forums.
Here’s the updated script — it replaces the debug logger with a targeted workaround. It tries the real portfolio/history request first, and only when Alpaca returns a 401/403 does it hand the app a harmless empty result with a 200 status, so the dashboard’s “any 401 → log out” logic never fires. It’s scoped strictly to that one broken endpoint — every other request is untouched, so real auth failures still behave normally. Since that endpoint is called via XHR (that’s what the trace showed), it patches XHR, plus fetch as a belt-and-suspenders.
javascript
// ==UserScript==
// @name Alpaca portfolio/history 401 workaround
// @namespace dbg
// @match https://app.alpaca.markets/*
// @run-at document-start
// @grant none
// ==/UserScript==
(function () {
'use strict';
const TARGET = '/portfolio/history';
const FAKE = JSON.stringify({
timestamp: [], equity: [], profit_loss: [], profit_loss_pct: [],
base_value: 0, base_value_asof: null, timeframe: '1D'
});
const isTarget = u => { try { return String(u).indexOf(TARGET) !== -1; } catch (e) { return false; } };
const bad = s => s === 401 || s === 403;
// ---- fetch path ----
const oF = window.fetch;
window.fetch = function (...a) {
const u = (a[0] && a[0].url) || a[0];
if (!isTarget(u)) return oF.apply(this, a);
return oF.apply(this, a).then(r => {
if (!bad(r.status)) return r;
console.warn('[alpaca-fix] neutralized', r.status, 'on portfolio/history (fetch)');
return new Response(FAKE, { status: 200, headers: { 'Content-Type': 'application/json' } });
}).catch(() => new Response(FAKE, { status: 200, headers: { 'Content-Type': 'application/json' } }));
};
// ---- XHR path (portfolio/history is an XHR/axios call) ----
const OX = window.XMLHttpRequest;
function NX() {
const x = new OX();
let url = '';
const open = x.open;
x.open = function (m, u) { url = u; return open.apply(x, arguments); };
// Registered at construction → fires before the app's own handlers, so we can
// rewrite status/body to a clean 200 before axios decides to reject on the 401.
x.addEventListener('readystatechange', function () {
if (x.readyState === 4 && isTarget(url) && bad(x.status)) {
try {
const rt = x.responseType;
Object.defineProperty(x, 'status', { configurable: true, get: () => 200 });
Object.defineProperty(x, 'statusText', { configurable: true, get: () => 'OK' });
Object.defineProperty(x, 'responseText', { configurable: true, get: () => FAKE });
Object.defineProperty(x, 'response', { configurable: true, get: () => (rt === 'json' ? JSON.parse(FAKE) : FAKE) });
console.warn('[alpaca-fix] neutralized 401 on portfolio/history (xhr)');
} catch (e) { console.warn('[alpaca-fix] xhr patch failed', e); }
}
}, false);
return x;
}
NX.prototype = OX.prototype;
window.XMLHttpRequest = NX;
console.log('[alpaca-fix] portfolio/history 401 workaround active');
})();
To use it:
- In Tampermonkey, either edit your existing debug script and replace its entire contents with the above, or disable/delete the debug one and create a new script with this. (Don’t run both — the old logger isn’t needed anymore.)
- Save (Cmd/Ctrl-S), make sure it’s toggled on.
- Hard-reload the Alpaca tab (Cmd-Shift-R) and log in.
2 Likes
I am experiencing this exact same issue right now.
Every time I log in, I see the "Success! logging you in..." message, only to be immediately booted back to the login screen a second later.
This makes the web dashboard completely unusable. I can't check my positions, manage my dashboard, or handle withdrawals.
Everyone, the Alpaca Engineering Team is working to get this fixed. A big thank you for all the troubleshoting detail. An issue that Engineering is having is they cannot reproduce, but the specifics here are a huge help. I’ll keep everyone posted.
2 Likes
Thank you sir. I had to modify mine a little but this let me get into my account finally.
Alpaca’s dashboard has a bug where it immediately logs you out after logging in. The root cause is that the internal endpoint /internal/paper_accounts/{id}/portfolio/history returns a 401 Unauthorized even though the session token is valid.
All other endpoints for the same paper account work fine with the same token.
Temporary Fix (Tampermonkey)
- Install Tampermonkey
- Go to Chrome extensions → Tampermonkey → Details → Enable “Allow User Scripts”
- Create a new script and paste this:
// ==UserScript==
// @name Alpaca Dashboard - Fix Portfolio History 401
// @namespace http://tampermonkey.net/
// @version 2.0
// @description Workaround for Alpaca's internal /portfolio/history 401 bug on paper accounts.
// @match https://app.alpaca.markets/*
// @run-at document-start
// ==/UserScript==
(function() {
'use strict';
const MOCK = { timestamp: [], equity: [], profit_loss: [], profit_loss_pct: [], base_value: 0, base_value_asof: null };
// fetch
const origFetch = window.fetch;
window.fetch = async function(r, i) {
const url = typeof r === 'string' ? r : (r && r.url) || '';
if (url.includes('/portfolio/history')) {
const res = await origFetch.apply(this, arguments);
return res.status === 401
? new Response(JSON.stringify(MOCK), { status: 200, headers: { 'Content-Type': 'application/json' } })
: res;
}
return origFetch.apply(this, arguments);
};
// XHR
const oOpen = XMLHttpRequest.prototype.open;
XMLHttpRequest.prototype.open = function(m, u, ...a) { this._url = u; return oOpen.apply(this, arguments); };
const oSend = XMLHttpRequest.prototype.send;
XMLHttpRequest.prototype.send = function(b) {
if (this._url && this._url.includes('/portfolio/history')) {
this.addEventListener('readystatechange', function() {
if (this.readyState === 4 && this.status === 401) {
Object.defineProperty(this, 'status', { value: 200 });
Object.defineProperty(this, 'responseText', { value: JSON.stringify(MOCK) });
Object.defineProperty(this, 'response', { value: JSON.stringify(MOCK) });
}
});
}
return oSend.apply(this, arguments);
};
})();
Hard refresh after saving. This should stop the logout loop until Alpaca fixes it
Bug Report: Dashboard logs out immediately after login (Paper accounts)
Issue:
After logging in, the dashboard shows for ~1 second then redirects back to /account/login.
Root Cause:
The internal endpoint GET /internal/paper_accounts/{uuid}/portfolio/history returns 401 Unauthorized even with a valid session token.
All other endpoints on the same paper account succeed with the same token:
- /positions
- /orders
- /margin
- /client-credentials
The dashboard treats any 401 as a session failure and forces a logout.
Evidence:
- Login succeeds and mints a valid token
- Only portfolio/history fails with 401
- Other authenticated calls return 200
- This is a server-side issue on Alpaca’s internal endpoint
Workaround:
Tampermonkey script that intercepts the failing request and returns a mock empty 200 response (posted above).
Request to Alpaca Engineering:
Please fix the authorization check on the internal portfolio/history service for paper accounts.
1 Like
Everyone, this issue has now been resolved, but please reply if anyone is still having issues. The engineering team is working on an incident report and it should be posted on the status page when complete.
Again thank you everyone for your detailed reports that was a big help.
3 Likes
Hi, I am still facing with this issue. I cant login into my account
@sinwave Could you provide more details when you say “I can’t login to my account”. What are you seeing after you enter your email and password?
Tried it just now - and it works! I don’t know what happened, but after registration and confirming my email, I just wasn’t able to log in. There was some small, quick pop-up about authorization. Anyway, now it works! Thank you!
@sinwave Glad to hear. Post back or send an email to support@alpaca.markets if you have further issues. Best of luck to you!