Authentication

All requests to the TradeWave API must be authenticated with an API key.

Bearer token scheme

Pass your key in the Authorization header on every request:

Authorization: Bearer <your-api-key>

There is no session, no cookie, and no OAuth flow for the REST API. Every request is independently authenticated against the key's HMAC hash stored in the database. The key itself is never stored in plaintext.

Key management in the console

1. Go to Account → API Keys in the dashboard.
2. Create - generates a new key. Copy it immediately; it is displayed only at creation time.
3. Rotate - revokes the old key and issues a new key and id in its place. Useful when you suspect a key has been exposed.
4. Revoke - permanently deletes a key. Requests using it will get 401.

Key limits by tier

More keys do not multiply your quota - limits are enforced per account, and every key under an account shares the same limits.

MCP authentication: sign in or bring your own key

TradeWave's MCP is a hosted HTTP server at https://mcp.tradewave.ai. It accepts two credentials:

• Consumer connections (ChatGPT, Claude.ai, Claude Desktop) - OAuth. Paste the server URL into the app's connector settings, click Connect, and sign in with your TradeWave account. No API key is involved; your plan follows the account you sign in with.
• Bring-your-own-key clients - BYOK. The MCP server accepts the same API keys as the REST API; there is no separate credential system. A client that needs a local stdio bridge can use the mcp-remote npx shim and pass the key in the Authorization header.

# Dev tool (Claude Desktop / Cursor): bridge with the mcp-remote shim
npx -y mcp-remote https://mcp.tradewave.ai \
  --header "Authorization: Bearer tw_live_abc123..."

Tier and entitlements (market scope, ML access, rate limits) are read directly from the signed-in account or the key - no additional configuration is needed. See MCP Reference for full connection instructions.

Error responses

Authentication errors return standard HTTP status codes:

Error body shape:

{
  "error": {
    "code":    "unauthorized",
    "message": "invalid or missing API key"
  }
}