Guide

Authentication & security

The API has exactly three access classes; every endpoint in the reference is labeled with one (plus its plan requirement, if any).

MCP token (Bearer)

Applies to the /api/mcp/data/* endpoints — the programmatic surface.
Send Authorization: Bearer avmcp_<token>. Tokens are SHA-256-hashed server-side and checked for active status and expiry; usage is recorded per call.
The Account → API Access tab (create/revoke your own tokens — up to 3 active, each secret shown once) is available on Pro accounts.
Pasting your token into your local Claude config (or a private setup chat) is the intended, safe way to wire this up. Only rotate a token if it's exposed somewhere public — a committed file, a shared screenshot, or a public post. Rotate any time under Account → API Access.
401 responses: missing/invalid header, wrong format (must start with avmcp_), revoked, or expired. 403 tier_required: the owning account isn't on an active Pro plan. 403 beta_required: API access isn't enabled on the owning account yet.

Session cookie + CSRF

Log in via /login or Google sign-in. Browser /api requests carry the secure session cookie automatically.
Write requests (POST/PUT/PATCH/DELETE) must include an X-CSRFToken header; fetch it from GET /api/csrf-token.
If a token expires the API responds 400 with {error, csrf_expired: true} — fetch a fresh token and retry.

curl

# fetch a CSRF token, then POST with it
TOKEN=$(curl -s -b cookies.txt https://apexvol.com/api/csrf-token | jq -r .token)
curl -b cookies.txt -X POST "https://apexvol.com/api/strategy/build" \
     -H "Content-Type: application/json" -H "X-CSRFToken: $TOKEN" \
     -d '{ "ticker": "AAPL", "strategy_type": "iron_condor" }'

Public & security notes

A small set of endpoints needs no auth (subject to demo-mode restrictions and rate limits).
Always use HTTPS; cookies are Secure/HttpOnly and tokens travel in headers.
Maintenance mode: when enabled, every API request returns 503 {error: 'maintenance'} for non-admins.
Tickers are validated against a strict pattern; out-of-range numeric parameters are clamped to documented bounds rather than rejected, unless stated otherwise.

← Getting started Plans & tiers →