Authentication

REST API keys

Every request authenticates with a tenant-bound API key sent as a bearer token:

1Authorization: Bearer mt5_live_012345abcdef_4f6a...

Keys are created in the control surface, shown once, and stored by FiveSocket only as an HMAC digest. If you lose a key, revoke it and create a new one.

MCP OAuth

Remote MCP clients use OAuth discovery, not a user-created API key. Start with the canonical endpoint https://api.fivesocket.com/mcp; the client reads protected-resource metadata and opens FiveSocket sign-in and consent. Grants are bound to the user, workspace, client, resource, and exact scopes. Short-lived MCP tokens are accepted only at /mcp, never at /v1 routes. Revoke a client from MCP connections in the control surface.

Never paste a REST API key or MT5 broker credentials into an assistant conversation. See MCP setup for the complete flow.

Scopes

Each key carries an explicit set of scopes. Requests without the required scope fail with insufficient_scope.

Scope	Grants
`accounts:read`	List linked accounts
`accounts:write`	Link and disable accounts
`data:read`	Live reads: balance, positions, trades, deals, orders, symbols, snapshot
`servers:verify`	Verify an exact MT5 server name
`trading:execute`	Configure execution policy and submit or reconcile trades

Create separate keys per consumer with the smallest scope set that works. A dashboard that only renders data needs data:read and nothing else.

Each key can use the plan maximum or a lower per-minute limit chosen when it is created. The key limit can never exceed the workspace plan.

Tenant identity

Tenant identity derives only from the authenticated key. Tenant or account identifiers in request bodies and query strings never grant authority; you can only ever reach accounts linked to your own tenant.

Credential handling

Account credentials are accepted only when linking an account and are never returned by any endpoint.
Credentials are encrypted at rest and delivered to disposable workers over standard input, never through environment variables or process arguments.
Responses that contain account data are Cache-Control: no-store.