The balance is the biggest thing on the page and updates in place. Everything else stays out of its way.
Every account starts with a personal workspace. When you want company, invite people in, choose what each one can do and see everything they did.
Your keys, your positions, your rules. A private desk that only you can open, on your phone or at your desk.
Share a workspace with a partner, a club or a small fund. Give a new teammate paper-only access while they learn.
Exchange sits on top of the Alpaca account you already have and keeps the parts you use every day close at hand.
Invite a partner, a club or your whole fund into one workspace. Everyone watches the same balance, and each person only does what their role allows.
Practice on a paper account, then trade live from the same screen. Live orders always ask before they go out.
Add as many Alpaca connections as you need, give each a name and switch between them in one tap.
Live prices flash as they change and your balance rolls over digit by digit, so updates read as motion instead of flicker.
NVDA $182.64
Check positions from a tab bar on your phone during the day, then trade from the full screen on your desktop.
Alpaca keys are encrypted the moment you save them and stay on the server. The browser only ever sees a masked key and whether it still works.
Exchange is fully open source. Every line that touches your keys and your orders is public on GitHub, so you can check how keys are encrypted, open an issue or run your own copy.
/** * Encrypts a secret with AES-256-GCM. * Stored form: `v1:<keyId>:<iv>:<tag>:<ciphertext>`, each binary part base64url. */export function encryptSecret(input: EncryptSecretInput): string { const encryptionKey = input.keys[0] if (!encryptionKey) { throw new Error('No encryption key is configured.') } const iv = randomBytes(IV_BYTES) const cipher = createCipheriv('aes-256-gcm', encryptionKey.key, iv) cipher.setAAD(Buffer.from(input.aad, 'utf8')) const ciphertext = Buffer.concat([ cipher.update(input.plaintext, 'utf8'), cipher.final(), ]) const tag = cipher.getAuthTag()Run Exchange on your own server, with your own database and your own encryption keys. Your Alpaca keys never leave a machine you control.
git clone https://github.com/jralvarenga/exchangecd exchange && bun installBun runs the whole monorepo.
cp apps/web/.env.sample apps/web/.env.localbun run auth:secretsPaste the auth secret and encryption keys it prints into .env.local.
docker compose up -dbun run db:migrateOr point DATABASE_URL at any Postgres you already run.
bun run buildbun run --filter web startIt listens on 127.0.0.1:3000. Put Caddy in front for HTTPS and set BETTER_AUTH_URL in .env.local to that https:// address.
Found a bug, want a feature or want to build something on top of Exchange? Open an issue, send a pull request or reach out on GitHub. Every contribution is welcome.
Create an account, add your Alpaca paper keys and place your first order in a few minutes.
