Manually entering every trade into a portfolio tracker takes time and creates room for error. A direct broker connection solves this, your real positions sync automatically, your trade history imports on its own, and your P&L is always accurate. Here's exactly how broker connections work, which ones are available, and whether they're actually safe.
The problem with manual portfolio tracking
Manual entry works fine when you have a handful of positions and trade infrequently. But for anyone with an active account, placing multiple trades a week, running positions across different asset classes, or managing more than one account, keeping a portfolio tracker in sync manually is a constant drain. Every trade requires logging in, finding the position, and updating the details. Miss one and your P&L figures drift from reality.
Broker connections solve this by making the sync automatic. Once you authorize the connection, your portfolio tracker pulls positions and trade history directly from your broker's API. You never have to enter a trade manually again.
How OAuth 2.0 broker connections actually work
The standard secure method for connecting a portfolio tracker to a broker is OAuth 2.0, the same authorization protocol used by "Sign in with Google" and bank-linked financial apps. Here's the flow:
- You click "Connect Broker" in the portfolio tracker and select your broker.
- You're redirected to your broker's website, not a third-party page. You log in with your normal broker credentials directly on your broker's domain.
- Your broker shows you what access is being requested, for example, "read portfolio positions and transaction history." You approve or deny.
- Your broker issues a time-limited access token, a string of characters that grants the portfolio tracker permission to read specific data from your account. Your password is never shared.
- The portfolio tracker stores this token securely and uses it to fetch your data on a regular interval.
The critical point: the portfolio tracker never sees your broker username or password at any stage. The OAuth flow happens entirely at your broker's domain. If you revoke access later, in the portfolio tracker or directly in your broker's settings, the token immediately stops working.
Read-only access: what it means and why it matters
Responsible broker integrations request only the minimum permissions needed, specifically, read-only access to positions and transaction history. This means:
- The portfolio tracker can see your holdings, balances, and completed trades.
- The portfolio tracker cannot place orders, cancel orders, transfer funds, or make any changes to your account.
- Even if the portfolio tracker's servers were somehow compromised, an attacker with your read-only token could not execute any trades or move any money.
PortfolioTrackr uses sync-only connections: it reads your positions and trade history and never places an order. Broker portfolios in PortfolioTrackr are labelled as managed by your broker and are locked against manual edits, the positions are your real live holdings, not something you can accidentally modify in the tracker.
Which brokers does PortfolioTrackr support?
Alpaca, Live now. Alpaca is a commission-free US stock and crypto broker with a well-documented API. If you have an Alpaca account, you can connect it to PortfolioTrackr in about 60 seconds. Your live positions sync automatically every 15 minutes.
Charles Schwab, via the SnapTrade bridge. Schwab has a developer API (via the TD Ameritrade merger infrastructure) that supports OAuth 2.0. PortfolioTrackr connects to Schwab through the SnapTrade bridge on Pro and Lifetime, and you log in on Schwab's own site. Your Schwab positions then sync automatically.
Interactive Brokers, Live now. IBKR covers more global markets than any other broker and has its own data-sharing program (IBRIT) for third-party integrations. PortfolioTrackr connects to IBKR directly on every plan, through a read-only Flex Query token you create in your IBKR account.
Kraken, via the SnapTrade bridge. Kraken is one of the most trusted global crypto exchanges. PortfolioTrackr connects to Kraken through the SnapTrade bridge on Pro and Lifetime. Your Kraken holdings then sync alongside your stock portfolios.
What if my broker isn't listed?
Not every broker offers a connection to third-party apps, so some are still missing from the list. If your broker isn't supported yet, PortfolioTrackr's AI import tools fill the gap. You can import trades by pasting a broker confirmation message, describing a trade by voice, uploading a screenshot of a trade summary, or importing a CSV export from your broker.
The result isn't quite as seamless as an automatic sync, but it's significantly faster than manual entry and works for any broker worldwide.
How are tokens stored securely?
PortfolioTrackr encrypts every access token using AES-256-CBC before storing it in the database. The encryption key is stored separately from the database. This means that even in the theoretical scenario of a database breach, the access tokens would be unreadable without the key. Tokens are decrypted only in memory, only when needed to make an API call to your broker, and never logged or exposed in responses.
What happens when a token expires?
Access tokens have a limited lifespan, typically a few hours to a few days, depending on the broker. PortfolioTrackr handles short-lived tokens automatically by using refresh tokens to obtain new access tokens in the background, without any action required from you.
If a refresh fails (for example, if you revoked access at the broker, or if the token expired after a long period of inactivity), PortfolioTrackr shows a reconnect banner on your broker portfolio. One tap takes you back through the OAuth flow to re-authorize. Your portfolio history and settings are preserved, only the connection needs to be refreshed.
Broker portfolio vs manual portfolio
Once a broker is connected, the synced portfolio in PortfolioTrackr is read-only, you can see all your positions and P&L, but you can't add or delete positions manually. This is intentional: the portfolio reflects your real account, and manual edits would make it inaccurate.
You can still keep a manual portfolio alongside your broker portfolio, and on Pro and Lifetime more than one. Many investors use a manual portfolio for tracking a watchlist, paper trading, or holdings in a broker that isn't yet supported. All portfolios appear in the same dashboard with a combined view available.
Frequently asked questions
Is it safe to connect my brokerage account to a portfolio tracker?
Yes, when done via OAuth 2.0. With OAuth, you log in at your broker's own website and grant access, the portfolio tracker never sees your password. All it receives is a time-limited access token. PortfolioTrackr encrypts this token using AES-256 before storing it.
Which brokers can I connect to PortfolioTrackr?
Alpaca, Bybit and Interactive Brokers connect directly on every plan, and 42 brokers including Charles Schwab and Kraken connect through the SnapTrade bridge on Pro and Lifetime. You can also track any broker manually using AI import from text, voice, or screenshots.
Can a connected portfolio tracker place trades for me?
No, if the connection is read-only. PortfolioTrackr never executes orders: we can view your positions and trade history but cannot execute orders, move funds, or make any changes to your account.
What happens to my data if I disconnect a broker?
PortfolioTrackr permanently deletes the positions, trade history and broker portfolio it created from that connection, and a later reconnect imports the data fresh. Disconnecting removes the OAuth token immediately, PortfolioTrackr can no longer access your broker account from that point.