There is no platform-wide account system, no OAuth, and no signup flow. If you have seen “sign up for an API key” phrased generically, it refers to one of the two keyed surfaces below — not to a single credential that unlocks everything.

​
By surface

​
Public endpoints: no credential

The signals feed, provider leaderboard, and temporal decomposition take no credential and set Access-Control-Allow-Origin: *.
This is deliberate. A published judgment about a named address that only paying customers can check is an assertion, not a verifiable claim. See API surfaces.

​
Self-hosted: localhost-only by default

The Python server binds 127.0.0.1:8777 and enforces nothing, because it is your own machine. The moment you put it behind a public tunnel, set a token:
state/config.json
Every route then requires:
A ?token= query parameter is also accepted for browser-only cases. Prefer the header — query strings land in server logs, browser history, and referrer headers.
No token configured means open to anyone who can reach the port. That is safe on loopback and unsafe the instant a tunnel is running. Setting the token is a manual step; nothing will prompt you.

​
Enterprise wallet API: X-API-Key

Mint a key with:
Keys are prefixed gcx_ so a leaked key is recognisable in a log, stored server-side as a SHA-256 hash, and displayed exactly once. There is no recovery path — reissue instead.

​
MCP server: tiered bearer token

Mint a key:
The token has the shape gc_{tier}_{48 hex} — for example gc_pro_9f3a.... Supply it through any one of these environment variables, checked in precedence order:
MCP_API_KEY is canonical and deliberately brand-neutral, so the pending rename does not invalidate the one setting every user pastes into a config file.

​
How keys are stored

The keystore never holds the token. It stores scrypt(token) plus a salt, and compares with timingSafeEqual over derived hashes. Key metadata (tier, label, creation time) is encrypted with AES-256-GCM.
Hashing rather than encrypting is the stronger choice here precisely because nothing in the system ever needs to read a key back. A design that can recover your key is a design that can leak it.
v1 plaintext keystores migrate in place on first load, so existing installs keep working without intervention.

​
Tiers

Every tier is additionally capped at 100 calls/minute. See Rate limits.

​
Calling the dashboard API from MCP

If your MCP server talks to a tunnelled dashboard, it sends GHOSTCOPY_API_TOKEN as its Authorization header. Omitting it is invisible on a laptop — no tunnel means an open gate — and fails everywhere else. health_check reports api.token_configured so you can confirm before deploying.
Scienter publishes impersonal market signals of general and regular circulation. Nothing here is investment, legal, or tax advice, or a recommendation to buy, sell, or hold any asset. Scienter is not a registered investment adviser or broker-dealer. Trading digital assets can result in the total loss of your funds — see Disclaimers for the full text.