Skip to main content
Two credential families. Both are header-only, and both draw on one per-user budget.

​
API keys

Mint a key in the dashboard: AI Agents & API → Patch Bay.
1

Open the Patch Bay

Dashboard → AI Agents & API. The Patch Bay is the rear panel where your ports live.
2

Mint

Give the key a label — one per agent or machine, so you can unplug one without disturbing the others.
3

Copy it now

The plaintext td_live_ token exists exactly once, in the mint response. We store only its hash and the last four characters for display. It cannot be shown again.
If you lose a key, you cannot recover it. Revoke it and mint a new one.

​
Rules that bite

  • Header only. A key is never accepted in a query string. A key in a URL is a key in an access log.
  • Revocation is instant. A revoked key fails on its very next call — there is no cache to wait out. Plan downgrades bite the next request too.
  • Keys are cables, not quota. Every key you own spends from the same call budget. A second key gives you a second plug, not a second allowance.

​
Ports per plan

The cap counts non-revoked keys. Minting past it returns 402 with a message naming your plan’s limit — unplug a key or upgrade.

​
OAuth (MCP)

Some MCP clients — the claude.ai custom connector, Claude Code, Cursor, opencode — can connect over OAuth instead of a pasted key. You sign in with your PolyTape account and consent; the client handles tokens from there. No key material is ever pasted or stored in a config file. The connect panel in the dashboard shows the exact per-client steps and whether OAuth is live for your client yet. Where it is not, the key + Authorization: Bearer path always works.
OAuth sessions and API keys spend from the same per-user budget. Connecting a different way does not get you a separate allowance.

​
What a key can and cannot do

Can

Read everything on this API — traders, markets, fills, tapes, the popular shelf — and open live agent streams for wallets. All read-only.

Cannot

Mint or manage keys (a dashboard action, never an API-key action), write anything, or place a trade. V1 is read-only by construction.

​
Auth failures

401s carry a WWW-Authenticate: Bearer header. See Errors for the full table.