Connect your broker

Connecting a brokerage is a delegated-authorization flow: the platform is the OAuth client to your broker. You click "connect your broker," authorize on Alpaca, and the platform holds a scoped token to act through your own account. Kestrel never takes custody, never buys a data license, and is not a broker-dealer.

A connector, not a login

Signing in (email, GitHub, Google) establishes who you are. Connecting Alpaca is separate — it links your broker to an account you are already signed in to. That is why it is a connector: it never creates or logs you in, it attaches a broker to your existing human account.

Two signatures, by design

Authorization on the platform is one primitive — the Envelope — with two signer classes. A wallet may sign reversible, commerce-only scope (data, sim, grade, paper). A human must sign anything carrying a legal agreement — connecting a broker, and live trading authority. So a broker connection always requires a human signer; no agent and no machine payment can establish it.

Your broker token is stored encrypted at rest on your human account and is reachable only under your own signed-in session. An autonomous agent operating in your workspace can never read it.

Paper first

Paper is the default and only initially-enabled environment. Once connected you can:

• see a read-only snapshot of your account and positions, and
• preview an intended order — a non-submitting validation against your buying power.

There is deliberately no order-routing path in the connector today. Placing real orders is a separate capability that arrives with the pod executor and its pre-flight EnvelopeGuard, and only under a separately human-signed live Envelope. Until then, nothing you connect can place a live order.

Connection states

You can disconnect (revoke) a connection at any time; the platform unlinks the token immediately.