How to call our API

GIFT City APIs use different hostnames for live and sandbox. Authenticate by exchanging a client ID and client secret for a short-lived access token, then send that token as Authorization: Bearer on every request.

Live and sandbox credentials are not interchangeable. If you have more than one correspondent, each has its own credentials.

Hosts

Get an access token

POST your client ID and client secret to the token endpoint. Tokens are valid for 15 minutes. Reuse a token until it expires; do not request a new one for each API call.

Pass client_secret in the request body (client_secret_post). Sending it in the Authorization header (client_secret_basic) is not supported.

Live example:

curl -X POST "https://authx.giftcity.in.alpaca.markets/v1/oauth2/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=client_credentials" \
     -d "client_id={YOUR_CLIENT_ID}" \
     -d "client_secret={YOUR_CLIENT_SECRET}"

The response:

{
    "access_token": "{TOKEN}",
    "expires_in": 899,
    "token_type": "Bearer"
}

Use that token on the matching Broker API host:

curl -X GET "https://broker-api.giftcity.in.alpaca.markets/v1/accounts" \
     -H "Authorization: Bearer {TOKEN}"

For sandbox, use the sandbox Authentication and Broker API hosts from the table above. The request shape is the same.