Skip to main content
Centaur uses different auth patterns by surface:
  • REST uses Centaur API keys.
  • MCP uses OAuth.

​
Access model

​
REST

Send the API key in the x-api-key header:
Use REST when you want direct HTTP control or a backend integration.

​
MCP

For MCP, the setup is:
  1. Add the plain MCP server URL: https://mcp.centaur.io/mcp
  2. Let the client discover the protected resource and authorization-server metadata
  3. Let the client dynamically register itself if it needs a new OAuth client
  4. Sign in to Centaur in the browser when prompted
  5. Approve the requested MCP access scopes
MCP OAuth is available to signed-in users whose Centaur account is active and email-verified.

​
OAuth metadata for builders

Interactive clients should start from the MCP resource URL:
The protected resource metadata is published at:
That metadata identifies the protected resource, supported bearer method, supported scopes, authorization server metadata, and docs URL. The MCP resource value is:
OAuth access tokens must be issued for that MCP resource audience. If the token is missing, invalid, for the wrong audience, or lacks supported scopes, the MCP endpoint returns WWW-Authenticate with the protected resource metadata URL and, where applicable, invalid_token or insufficient_scope.

​
Read scopes

Each endpoint family and MCP capability family uses the matching read scope:
  • events.read for events
  • messages.read for messages
  • feed.read for the partner feed
  • summaries.read for generated narrative summaries
  • positions.read for open and closed position reads
  • directory.read for trader and asset discovery
  • stats.read for trader and asset stats
Centaur may provision one account or key with multiple read scopes.

​
OpenAI API note

This page covers interactive MCP clients such as ChatGPT and Codex. Some OpenAI API-side MCP integrations may still require your application to obtain and supply an OAuth access token directly instead of relying on an interactive browser flow.

​
REST example

​
Notes

  • REST uses API keys in both v1 and v2.
  • MCP does not accept Centaur API keys.
  • MCP OAuth requires an active Centaur account with a verified email.
  • Some results may be omitted rather than returned with a warning when they fall outside the current access or eligibility rules.
  • Swagger at https://api.centaur.io/v2/docs is a secondary technical reference, not the canonical docs surface.
Last modified on September 11, 2026