Authentication
API keys, test mode, and OAuth for the MCP server.
API keys (REST)
Send your key as a Bearer token on every request:
curl https://api.signals.ai/v1/coverage/AAPL \
-H "Authorization: Bearer sk_live_…"Keys are created and managed at developers.signals.ai. The secret is shown once at creation — we store only a salted hash, so if you lose it, rotate it.
Live vs test keys
| Prefix | Behavior |
|---|---|
sk_live_… | Counts against your plan's limits. |
sk_test_… | Clamped to Free-tier limits; use in CI and sandboxes. |
A missing or invalid key returns 401 with a WWW-Authenticate: Bearer header.
Clerk session tokens are not accepted on the REST surface — that's the
internal app's auth, not the developer API's.
{
"type": "https://docs.signals.ai/errors/invalid-key",
"title": "Invalid API key",
"status": 401,
"detail": "Missing or invalid API key.",
"request_id": "req_0dc23f9b4a0f8f2a",
"instance": "/v1/companies/UBER"
}MCP authentication
The supported production path for the MCP server is an API key:
- API key — send
sk_live_…orsk_test_…as a Bearer token. Prefer an environment variable or the client's encrypted secret store.
The endpoint also publishes OAuth protected-resource metadata for future hosted integrations. Signals is not currently listed in the ChatGPT or Claude directories, so do not rely on a marketplace OAuth flow yet.
Rate limits
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and
X-RateLimit-Reset (epoch seconds). A 429 includes Retry-After. See
rate limits for per-tier quotas and endpoint
weights.