Authentication

API keys (REST)

Send your key as a Bearer token on every request:

curl https://api.signals.ai/v1/coverage/AAPL \
  -H "Authorization: Bearer sk_live_…"

Keys are created and managed at developers.signals.ai. The secret is shown once at creation — we store only a salted hash, so if you lose it, rotate it.

Live vs test keys

Prefix	Behavior
`sk_live_…`	Counts against your plan's limits.
`sk_test_…`	Clamped to Free-tier limits; use in CI and sandboxes.

A missing or invalid key returns 401 with a WWW-Authenticate: Bearer header. Clerk session tokens are not accepted on the REST surface — that's the internal app's auth, not the developer API's.

{
  "type": "https://docs.signals.ai/errors/invalid-key",
  "title": "Invalid API key",
  "status": 401,
  "detail": "Missing or invalid API key.",
  "request_id": "req_0dc23f9b4a0f8f2a",
  "instance": "/v1/companies/UBER"
}

Bearer tokens

Exchange a key for a 24-hour bearer token when a client should not hold the key itself (the Excel add-in does this):

curl -X POST https://api.signals.ai/v1/auth/token -H "Authorization: Bearer $SIGNALS_KEY"

{"access_token": "st_…", "token_type": "bearer", "expires_in": 86400,
 "expires_at": "2026-09-30T10:00:00+00:00", "tier": "builder",
 "key_prefix": "sk_live_ab12", "limits": {"daily_request_limit": 100000}}

The token carries the key's plan, is accepted everywhere the key is (/v1 and the MCP server), and is metered to the key. It stops working after 24 hours, or as soon as its key is revoked or rotated.

Rotating a key

POST /api/infra/keys/{id}/rotate (developer portal) issues a new key. The old key keeps working for a 24-hour grace period so you can deploy the new one; its bearer tokens stop at once, and it can mint no new ones.

MCP authentication

The supported production path for the MCP server is an API key:

API key — send sk_live_… or sk_test_… as a Bearer token. Prefer an environment variable or the client's encrypted secret store.

The endpoint also publishes OAuth protected-resource metadata for future hosted integrations. Signals is not currently listed in the ChatGPT or Claude directories, so do not rely on a marketplace OAuth flow yet.

Rate limits

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset (epoch seconds). A 429 includes Retry-After. See rate limits for per-tier quotas and endpoint weights.