Authentication

AI assistants such as ChatGPT and Claude connect to the MCP server over OAuth: you sign in to Equibles and approve access, so there's no key to copy or store. The REST API, spreadsheet feeds and any MCP client you configure with a key use an API key.

Public tool discovery: the default https://mcp.equibles.com/mcp endpoint allows the handshake and tools/list without signing in. Clients and directories can discover the full catalogue anonymously; requesting data requires authentication. The optional ?auth=oauth setup URL described below requests authorization earlier.

OAuth (MCP connectors)

ChatGPT, Claude (web, Desktop, and Code), Cursor, VS Code, Google Antigravity and Grok can connect to the MCP server without an API key. Paste https://mcp.equibles.com/mcp into the client's connector settings (ChatGPT can also install Equibles from its plugin directory) and sign in to Equibles to approve access. The client then holds a short-lived OAuth token instead of a key. Approve the stay-connected permission, if requested, so the client can renew access after that token expires. Step-by-step for each client is under Connect the MCP server.

Grok uses https://mcp.equibles.com/mcp?auth=oauth to start authorization during setup. Keep the default URL for ChatGPT, Claude, and other working connections.

API keys

Create keys in your dashboard. A key starts with the prefix eq_ and is shown once at creation — copy it then and store it somewhere safe. We only keep a hash, so a lost key can't be recovered; create a new one and delete the old.

Organization owners and admins can also create organization API keys, which belong to the organization rather than a person and are sent exactly the same way.

Sending your key

Provide the key one of two ways. The Authorization header is preferred.

Authorization header

curl "https://api.equibles.com/v1/stocks/AAPL/prices" \
  -H "Authorization: Bearer eq_your_api_key"

Query parameter — useful where you can't set headers (for example an MCP client that only takes a URL):

https://api.equibles.com/v1/stocks/AAPL/prices?api_key=eq_your_api_key

apiKey is accepted as an alias for api_key.

A key in the URL can end up in logs and browser history. Prefer the header, and treat any URL that contains a key as a secret.

Connection troubleshooting

A client can discover the public tool list and show Connected before completing account authorization. Seeing the tools does not prove that data requests are authenticated.

If your client supports OAuth but never opens sign-in, try this supported setup URL:

https://mcp.equibles.com/mcp?auth=oauth

The auth=oauth query parameter requests authorization from the first connection request. It contains no secret and requires no API key. It is a troubleshooting option for other OAuth clients and the recommended setup for Grok; working connections can keep their existing URL.

Disconnect Equibles in your client, then add it again with the full URL above and select OAuth if the client asks for an authentication method.
Complete the Equibles sign-in and permission prompt. An existing Equibles session may take you straight to the permission screen. Approve the stay-connected permission if requested.
Start a new conversation and ask: "Using Equibles, pull Tesla revenue for the last 5 years." Confirm the client calls Equibles and returns data.

Revoking access in Equibles' Connected Apps does not update the server URL saved in your client. If sign-in still does not open, check the saved URL and your client's OAuth support. This parameter cannot add OAuth support to a client that lacks it; use that client's API-key setup instead.

Using an API key and receiving 401 / access denied

Copy the full key when it is created in API keys, not the shortened prefix displayed later. Send it using the Authorization: Bearer header or the api_key URL parameter. These are separate authentication methods; adding auth=oauth does not repair an invalid API key.

The request still fails

If Equibles returns a quota or plan message, follow Plans & limits or the access instructions in that message; reconnecting does not change the allowance. An HTTP 403 from the MCP server means the OAuth token is missing the required mcp scope; re-run the connector's sign-in to fix it. If authorization still fails, contact support with the client name, error, approximate time, and timezone. Leave API keys and tokens out of screenshots and messages.

Keeping keys safe

Use a separate key per integration so you can revoke one without affecting the others.
Keep keys server-side. Never commit them to source control or ship them in client-side code.
Rotate on a schedule, and immediately if a key may have leaked — delete it in the dashboard and create a new one.
All requests must be over HTTPS.