Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@master-chief/alpaca
Advanced tools
A TypeScript Node.js library for the https://alpaca.markets REST API and WebSocket streams.
New!
Support for the Market Data API v2 is here. This library's version has been incremented to5.1.3-beta
as some breaking changes were made to theAlpacaStream
class. It will remainbeta
until Alpaca marks a stable version of the data API.
A TypeScript Node.js library for the https://alpaca.markets REST API and WebSocket streams.
AlpacaClient
and AlpacaStream
classes.alpaca.js
- ESM bundle (for node)alpaca.bundle.js
- ESM bundle with dependencies (for node)alpaca.browser.js
- UMD bundle (for browser)alpaca.browser.modern.js
- ESM modern bundle (for browser)From NPM:
> npm i @master-chief/alpaca
From GitHub:
From these popular CDNs:
Import with CommonJS:
let { AlpacaClient, AlpacaStream } = require('@master-chief/alpaca')
Import with ESM:
import { AlpacaClient, AlpacaStream } from '@master-chief/alpaca'
Import as script:
<script src="https://unpkg.com/@master-chief/alpaca/dist/alpaca.browser.min.js"></script>
Import as module:
<script type="module">
import alpaca from 'alpaca.browser.modern.min.js'
</script>
If you wish to use env vars, populate these fields with process.env
on your
own. Paper account key detection is automatic. Using OAuth? Simply pass an
access_token
in the credentials object.
const client = new AlpacaClient({
credentials: {
key: 'xxxxxx',
secret: 'xxxxxxxxxxxx',
// access_token: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
paper: true,
},
rate_limit: true,
})
Alpaca provides numbers as strings. From their docs:
Decimal numbers are returned as strings to preserve full precision across platforms. When making a request, it is recommended that you also convert your numbers to strings to avoid truncation and precision errors.
This package provides numbers as number
instead, and date strings as Date
objects which is what most developers want out of the box. If you want the
original data, as it came from Alpaca, you can call raw()
on any entity.
const account = await client.getAccount()
console.log(typeof account.buying_power) // number
console.log(typeof account.raw().buying_power) // string
The following methods are available on the client.
await client.isAuthenticated()
await client.getAccount()
await client.getOrder({ order_id: '6187635d-04e5-485b-8a94-7ce398b2b81c' })
await client.getOrders({ limit: 25, status: 'all' })
await client.placeOrder({
symbol: 'SPY',
qty: 1,
side: 'buy',
type: 'market',
time_in_force: 'day',
})
await client.replaceOrder({
order_id: '69a3db8b-cc63-44da-a26a-e3cca9490308',
limit_price: 9.74,
})
await client.cancelOrder({ order_id: '69a3db8b-cc63-44da-a26a-e3cca9490308' })
await client.cancelOrders()
await client.getPosition({ symbol: 'SPY' })
await client.getPositions()
await client.closePosition({ symbol: 'SPY' })
await client.closePositions()
await client.getAsset({ asset_id_or_symbol: 'SPY' })
await client.getAssets({ status: 'active' })
await client.getWatchlist({ uuid: '2000e463-6f87-41c0-a8ba-3e40cbf67128' })
await client.getWatchlists()
await client.createWatchlist({
name: 'my watchlist',
symbols: ['SPY', 'DIA', 'EEM', 'XLF'],
})
await client.updateWatchlist({
uuid: '2000e463-6f87-41c0-a8ba-3e40cbf67128',
name: 'new watchlist name',
symbols: ['TSLA', 'AAPL'],
})
await client.addToWatchlist({
uuid: '2000e463-6f87-41c0-a8ba-3e40cbf67128',
symbol: 'F',
})
await client.removeFromWatchlist({
uuid: '2000e463-6f87-41c0-a8ba-3e40cbf67128',
symbol: 'F',
})
await client.deleteWatchlist({ uuid: '2000e463-6f87-41c0-a8ba-3e40cbf67128' })
await client.getCalendar({ start: new Date(), end: new Date() })
await client.getClock()
await client.getAccountConfigurations()
await client.updateAccountConfigurations({
no_shorting: true,
suspend_trade: true,
})
await client.getAccountActivities({ activity_type: 'FILL' })
await client.getPortfolioHistory({ period: '1D', timeframe: '1Min' })
await client.getTrades({
symbol: 'SPY',
start: new Date('2021-02-26T14:30:00.007Z'),
end: new Date('2021-02-26T14:35:00.007Z'),
})
await client.getQuotes({
symbol: 'SPY',
start: new Date('2021-02-26T14:30:00.007Z'),
end: new Date('2021-02-26T14:35:00.007Z'),
})
await client.getBars({
symbol: 'SPY',
start: new Date('2021-02-26T14:30:00.007Z'),
end: new Date('2021-02-26T14:35:00.007Z'),
timeframe: '1Min',
})
If you wish to use env vars, populate these fields with process.env
on your
own.
import { AlpacaStream } from '@master-chief/alpaca'
const stream = new AlpacaStream({
credentials: {
key: 'xxxxxx',
secret: 'xxxxxxxxxxxx',
paper: true,
},
type: 'market_data', // or "account"
source: 'iex', // or "sip" depending on your subscription
})
The following methods are available on the stream.
Channel | Type |
---|---|
trade_updates | account |
trades | market_data |
quotes | market_data |
bars | market_data |
stream.once('authenticated', () =>
stream.subscribe('bars', ['SPY', 'AAPL', 'TSLA']),
)
stream.unsubscribe('bars', ['SPY'])
stream.on('message', (message) => console.log(message))
stream.on('trade', (trade) => console.log(trade))
stream.on('bar', (bar) => console.log(bar))
stream.on('quote', (quote) => console.log(quote))
stream.on('trade_updates', (update) => console.log(update))
stream.on('error', (error) => console.warn(error))
Don't know where to start? Check out our community-made examples here.
Feel free to contribute and PR to your 💖's content.
FAQs
A TypeScript Node.js library for the https://alpaca.markets REST API and WebSocket streams.
The npm package @master-chief/alpaca receives a total of 113 weekly downloads. As such, @master-chief/alpaca popularity was classified as not popular.
We found that @master-chief/alpaca demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.