> ## Documentation Index
> Fetch the complete documentation index at: https://partners.centaur.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> REST uses Centaur API keys; MCP uses OAuth in supported clients.

export function ApiAccessNote() {
  return <>
      REST uses a Centaur API key. MCP prefers OAuth in supported clients; OAuth is available to signed-in users with
      an active, email-verified Centaur account.
    </>;
}

Centaur uses different auth patterns by surface:

* `REST` uses Centaur API keys.
* `MCP` uses OAuth in supported clients.

## Access model

<ApiAccessNote />

## REST

Send the API key in the `x-api-key` header:

```text theme={null}
x-api-key: <api-key>
```

Use REST when you want direct HTTP control or a backend integration.

## MCP preferred path

For MCP, the preferred setup is:

1. Add the plain MCP server URL: `https://partners.centaur.io/mcp`
2. Let the client discover the protected resource and authorization-server metadata
3. Let the client dynamically register itself if it needs a new OAuth client
4. Sign in to Centaur in the browser when prompted
5. Approve the requested MCP access scopes

MCP OAuth is available to signed-in users whose Centaur account is active and email-verified.

## OAuth metadata for builders

Interactive clients should start from the MCP resource URL:

```text theme={null}
https://partners.centaur.io/mcp
```

The protected resource metadata is published at:

```text theme={null}
https://partners.centaur.io/.well-known/oauth-protected-resource/mcp
```

That metadata identifies the protected resource, supported bearer method, supported scopes, authorization server metadata, and docs URL. The MCP resource value is:

```text theme={null}
https://partners.centaur.io/mcp
```

OAuth access tokens must be issued for that MCP resource audience. If the token is missing, invalid, for the wrong audience, or lacks supported scopes, the MCP endpoint returns `WWW-Authenticate` with the protected resource metadata URL and, where applicable, `invalid_token` or `insufficient_scope`.

## Read scopes

Each endpoint family and MCP capability family uses the matching read scope:

* `events.read` for events
* `messages.read` for messages
* `feed.read` for the partner feed
* `summaries.read` for generated narrative summaries
* `positions.read` for open and closed position reads
* `directory.read` for trader and asset discovery
* `stats.read` for trader and asset stats

Centaur may provision one account or key with multiple read scopes.

## OpenAI API note

This page covers interactive MCP clients such as ChatGPT and Codex. Some OpenAI API-side MCP integrations may still require your application to obtain and supply an OAuth access token directly instead of relying on an interactive browser flow.

## REST example

```bash theme={null}
curl -s 'https://partners.centaur.io/api/v1/events?limit=10' \
  -H 'x-api-key: <api-key>'
```

## Notes

* REST stays on API keys in v1.
* MCP OAuth requires an active Centaur account with a verified email.
* Some results may be omitted rather than returned with a warning when they fall outside the current access or eligibility rules.
* Swagger at <code>[https://partners.centaur.io/api/v1/docs](https://partners.centaur.io/api/v1/docs)</code> is a secondary technical reference, not the canonical docs surface.

## Related pages

* [REST documentation](/docs/guides/rest/overview)
* [Client setup](/docs/guides/mcp-agents/client-setup)
* [Error conventions](/docs/api-reference/conventions/errors)