> ## Documentation Index > Fetch the complete documentation index at: https://docs.openfinance.tech/llms.txt > Use this file to discover all available pages before exploring further. # Authentication > Your agent has to prove it acts for your account before it can call any tool. Here is how to choose between signing in and using a key, and how to set up each. There are two ways to do it, OAuth sign-in or an API key, and both act on your own OpenFinance account. There is no keyless tier, even for market data. Please make an account at [openfinance.tech](https://openfinance.tech) to get your keys. ## Two ways to authenticate The right choice depends mostly on your client. | | OAuth sign-in | API key | | - | - | - | | How | Add the server URL only. Your client opens an OpenFinance sign-in and consent page | Send your key in an `x-api-key` header | | Good for | Chat clients and editors that support OAuth for remote MCP servers, such as Claude, ChatGPT, Cursor, VS Code and Claude Code | Scripts, bots, servers, and clients without OAuth support | | What your client stores | A token it manages for you | Your API key | Use OAuth when your client supports it, because no long-lived secret has to be pasted anywhere. Use the API key when you are writing code or when a client only accepts headers. ## OAuth sign-in **1. Add the URL** Add `https://api.openfinance.tech/agent/mcp` to your client with no header. **2. Sign in** The first time the client uses the server, it opens an OpenFinance page. Sign in. If you are new, signing in creates your account. **3. Approve the connection** A consent page names the client that is asking. Approve it, then confirm a second time. The second screen reminds you that the client will be able to place orders and move funds from your wallet. > [!WARNING] > > Only approve a connection you started yourself. If a consent page appears that you did not expect, close it. For client builders: the server follows the MCP authorization flow. A client discovers the authorization server from the `WWW-Authenticate` header on the first `401`, registers itself dynamically, and uses PKCE. ## API key Your account has one API key. It starts with `open_`. **1. Open External AI** Sign in at [openfinance.tech](https://openfinance.tech) and open **External AI** in the sidebar. **2. Copy the key** Under **Connect OpenFinance to your AI** you see the MCP server URL and your API key, each with a copy button. **3. Send it as a header** Add `x-api-key: open_...` to every request, or to your client's MCP config. ![OpenFinance External AI page with the Connect OpenFinance to your AI card showing the MCP server URL and a masked API key with copy buttons](https://mintcdn.com/openfinance/vddFvZTr4V6TqP3x/images/screens/mcp-external-ai-credentials.png?fit=max\&auto=format\&n=vddFvZTr4V6TqP3x\&q=85\&s=dc95e691d7213925fbe39c6884bed01a) The External AI page shows the MCP server URL and your API key Keep the key in an environment variable rather than in a file: ```bash theme={"system"} export OPENFINANCE_API_KEY="open_..." ``` ```bash theme={"system"} curl -s https://api.openfinance.tech/agent/mcp \ -H "x-api-key: $OPENFINANCE_API_KEY" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' ``` The same key also works for the [Inference API](https://docs.openfinance.tech/inference/overview.md). > [!WARNING] > > Treat your API key like a password. It carries the same permissions as your account, including placing trades and sending funds from your wallet. Never commit it, and never paste it into a shared chat, an issue or a screenshot. ## What happens without credentials When a call is not authenticated, the response tells you what went wrong and how to fix it. | Response | Meaning | Fix | | - | - | - | | `401` with no key and no sign-in | Expected. The server points OAuth clients to the sign-in page | Sign in, or add the `x-api-key` header | | `401` with a key | The key is wrong or malformed | Copy it again from External AI and check that it starts with `open_` | | `412` | You are signed in, but account setup is incomplete for this action | Open [openfinance.tech](https://openfinance.tech), finish setup, and follow the instructions in the error | A `401` applies to every tool, read-only ones included. If a guide elsewhere says market data works without a key, it is out of date. ## Tips * One key covers every tool and the inference API. You do not need a key per venue. * Check that the key and wallet work with one call to `get_wallet_addresses`. See [Verifying the connection](https://docs.openfinance.tech/reference/verifying-connection.md). * Do not put the key into the model's context. Send it in headers only. * Prefer environment variable expansion in config files, for example `${OPENFINANCE_API_KEY}`, where your client supports it. ## FAQ > [accordion] Can I use both OAuth and a key? > > Use one per client. A client that sends the `x-api-key` header does not need the sign-in page. > [accordion] Does an API key limit what an agent can do? > > No. A key acts as your account. Control comes from confirmations: the agent is instructed to ask before every write, and your client can ask for tool approval. See [Safety and custody](https://docs.openfinance.tech/reference/safety-and-custody.md). > [accordion] The sign-in page says there is no API key on my account > > Open [openfinance.tech](https://openfinance.tech) once while signed in so the key is created, then retry. ## Next > [card] [MCP overview](https://docs.openfinance.tech/mcp/overview.md) > > Endpoint, flow and tool families. > [card] [API keys](https://docs.openfinance.tech/getting-started/api-keys.md) > > Getting started with your key. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.