There are two unrelated key systems. A key from one is meaningless to the other.

​
MCP server keys

Format: gc_{tier}_{48 hex}. Supply via MCP_API_KEY (canonical), or the accepted aliases SCIENTER_MCP_API_KEY / GHOSTCOPY_API_KEY. All tiers share a 100 calls/minute ceiling. See Rate limits.

​
Storage

The keystore holds scrypt(token) plus a salt — never the token. Metadata (tier, label, creation time) is encrypted with AES-256-GCM. Comparison is timingSafeEqual over derived hashes. List keys by fingerprint:

​
Enterprise wallet API keys

Format: gcx_..., prefixed so a leaked key is recognisable in a log. Stored as a SHA-256 hash. Sent as X-API-Key.

​
No recovery, by design

Keys are shown exactly once and cannot be retrieved. Both systems store one-way hashes.If a key is lost, issue a new one and revoke the old. There is no “reveal key” path, and building one would require storing keys in a recoverable form — which is precisely the property that makes a keystore breach catastrophic instead of inconvenient.

​
Rotation

There is no automatic expiry or forced rotation. Rotation is:
1

Issue the replacement

Both systems accept multiple valid keys, so you can overlap.
2

Deploy it

Update the environment variable or header everywhere it is consumed.
3

Revoke the old key

Remove it from the keystore. Verify traffic has moved first — nothing warns you that a key is still in use.

​
Operational guidance

One key per consumer

The call log records the caller’s tier and key fingerprint. Shared keys make an incident unattributable.

Never commit a key

apps/mcp-server/apikeys.local.json is local state. The gc_ and gcx_ prefixes exist so secret scanners can catch a mistake — configure yours to look for them.
Scienter publishes impersonal market signals of general and regular circulation. Nothing here is investment, legal, or tax advice, or a recommendation to buy, sell, or hold any asset. Scienter is not a registered investment adviser or broker-dealer. Trading digital assets can result in the total loss of your funds — see Disclaimers for the full text.