Auth + keys
Bearer keys, account-scoped, revocable in one click.
The key
Create a key on the Developer page. It is shown once, authenticates your account and spends its credits. Keys contain edk_live_ plus 43 base62 characters; only the SHA-256 hash and last four characters are stored.
Authorization: Bearer edk_live_...
Hosted MCP connections use browser OAuth instead. The MCP client renews that connection silently, so users do not copy API keys into Codex, Claude, Cursor, or VS Code.
What a key can do
| SCOPE | GRANTS |
|---|---|
research:read | query, snapshot, registry and reports. |
research:interpret | the natural-language proposer (POST /interpret). Included on MCP setup keys and metered separately: every call spends provider money. |
The optional research:hypotheses scope permits private hypothesis history writes in the Radar admin pilot. Existing keys keep their current permissions. Alerts, trading and report publishing are not authorized by this scope.
Where keys end
Keys terminate at the web layer. Each request mints a short-lived signed entitlement (the same one the app uses) and forwards your query to the research engine; the engine never sees or stores API keys. Revoking a key on the Developer page kills it immediately: revocation is a database row, not a cache.
Auth errors
| STATUS | CODE | MEANING |
|---|---|---|
| 401 | AUTH_REQUIRED | no Authorization header, or not a bearer key. |
| 401 | KEY_INVALID | the key is not recognized. |
| 401 | KEY_REVOKED | the key existed and was revoked. |
| 403 | SCOPE_MISSING | the key lacks the scope this endpoint needs. |
Transport errors use one envelope: {"error": message, "code": CODE}. Validation errors are different animals: see the grammar.