- Guides
- Authentication
Authentication
Send a TradeEasy key on every request. Personal keys work for the REST API and the MCP server; assistants that sign in with OAuth never see one.
Put the key in the X-API-Key header. Clients that can only send a bearer token may use Authorization: Bearer with the same key. HTTPS only.
curl "https://api.tradeeasyai.net/public/v1/cot/XAUUSD" \
-H "X-API-Key: $TRADEEASY_API_KEY"Key types#
| Prefix | Kind | Works with | Where it comes from |
|---|---|---|---|
| te_pub_… | Personal key | REST API and MCP | Account → API. One active key per account, shown once. |
| te_mcp_at_… | OAuth token | MCP only | Issued to Claude, ChatGPT and Claude Code when you press Approve. You never handle it. |
| te_org_… | Organization key | Embeds and the MCP add-on | Created by an organization owner in the partner portal, with scopes and an optional IP allowlist. |
A missing, invalid or revoked key, or a locked account, returns 401. A plan without the REST API, or a lapsed subscription, returns 403. Both use FastAPI’s detail body rather than the error envelope.
{
"detail": "Missing or invalid API key. Include X-API-Key header with your te_pub_ key."
}Organization keys and scopes#
For partners. An organization owner or admin creates them in the partner portal, limits them to scopes and, optionally, to IP ranges. Each key has its own per-minute limit and the organization a monthly quota. Send X-End-User to count your own users (stored salted).
| Scope | Grants |
|---|---|
| read:sentiment | Sentiment widgets and endpoints |
| read:risk | Risk widgets |
| read:signals | Signals and ideas |
| read:calendar | Economic calendar |
| read:reports | Pre-market and end-of-day reports |
| read:cot | COT positioning |
| agent:query | Ask (Atlas) conversations, metered |
| mcp:query | MCP server; paid add-on, enabled by TradeEasy |
Organization keys come with a partnership: For business.
X-API-Key: <organization key>
X-End-User: <your stable user reference>Keep keys secret#
- Call the API from a server, never from browser or app code.
- One personal key is active at a time; rotating it replaces the old key at once.
- Revoke a key you think has leaked. OAuth connections keep working.
# .env
TRADEEASY_API_KEY=YOUR_KEYEducational market research, not investment advice; not for fully automated trade execution. Questions about the API or the MCP server: support@tradeeasyai.net.