Authentication
All requests are authenticated with a bearer token sent in the Authorization header. REST calls use API keys — no sessions, no per-request signing. Agent connections over MCP can also authenticate with OAuth.
Issuing keys
Keys are issued from the dashboard at tickerbot.io/dashboard/keys. Sign up free (no card) and mint your first key from the dashboard.
Header format
One bearer header on every request — REST and websocket alike.
Authorization: Bearer YOUR_KEYRequests without this header return 401 Unauthorized. Invalid keys return 401 with { "error": "unauthenticated", "message": "..." } in the response body.
Verify your key
Any authenticated read works as a probe; the cheapest is one ticker.
curl "https://api.tickerbot.io/v2/tickers/AAPL" \
-H "Authorization: Bearer YOUR_KEY"A 200 indicates the key is valid. 401 indicates the key is missing or invalid; 403 indicates the key is valid but the requested capability is not enabled for the account.
OAuth for agent connections
The MCP endpoint at https://api.tickerbot.io/mcp also speaks OAuth 2.1, so agent clients connect with a per-user consent flow instead of a pasted key; connected apps are revocable at tickerbot.io/dashboard/connected-apps. REST endpoints stay key-authenticated, and a bearer key keeps working on /mcp unchanged.
Revoking keys
Revoke an exposed key from tickerbot.io/dashboard/keys: revocation takes effect immediately, and any request still using the key returns 401.
Rate limits
Limits are per account, not per key — every key you issue shares one per-minute window. Crossing it returns 429 rate_limit_exceeded with a Retry-After header. Caps, headers, and backoff guidance are on the Errors & rate limits page.
Trying it without a key
Every read endpoint also answers at /v2/sandbox/… with no key — the same handlers and the same responses, budgeted at 30 requests per hour and 60 per day per IP. That is what the Run buttons in these docs call. Signed in, your account’s per-minute limit applies instead.