View as markdown
Getting started

Authentication

All requests are authenticated with a bearer token sent in the Authorization header. REST calls use API keys — no sessions, no per-request signing. Agent connections over MCP can also authenticate with OAuth (below).

Issuing keys

Keys are issued from the dashboard at tickerbot.io/dashboard/keys. Sign up free (no card) and mint your first key from the dashboard.

Header format

Authorization: Bearer YOUR_KEY

Requests without this header return 401 Unauthorized. Invalid keys return 401 with { "error": "unauthenticated", "message": "..." } in the response body.

Verify your key

curl "https://api.tickerbot.io/v2/tickers/AAPL" \
  -H "Authorization: Bearer YOUR_KEY"

A 200 indicates the key is valid. 401 indicates the key is missing or invalid; 403 indicates the key is valid but the requested capability is not enabled for the account.

OAuth for agent connections

The MCP endpoint at https://api.tickerbot.io/mcp also speaks OAuth 2.1, so agent clients connect with a per-user consent flow instead of a pasted key; connected apps are revocable at tickerbot.io/dashboard/connected-apps. REST endpoints stay key-authenticated, and a bearer key keeps working on /mcp unchanged.

Revoking keys

Revoke an exposed key from tickerbot.io/dashboard/keys: revocation takes effect immediately, and any request still using the key returns 401.