Authentication

Every request needs an API key — a secret code that identifies you. You get one from your ByteTrend.io account and send it with each request in the Authorization header. A key on the Analyst (API + MCP) plan opens everything in this documentation: every endpoint, every universe and the ByteTree MCP.

One exception: ByteTree MCP also accepts account sign-in. You can add it to a client by URL and sign in with your ByteTree account instead of configuring a key — see MCP authentication. The plan requirement is the same either way.

Under the hood, a key carries a capability — whether it may use the API and MCP at all — and is checked on every request. Keys do not carry a universe scope. See the Changelog for the cutover note if you integrated while the API was open.

Passing your key

Send the key in the Authorization header using the Bearer scheme:

curl https://api.bytetree.io/api/assets \
-H "Authorization: Bearer YOUR_API_KEY"

The same header works for every protected endpoint and for every response format (json, csv, toon).

Obtaining a key

API keys come from your ByteTrend.io account:

1. Sign in at bytetrend.io.
2. Open Account → Billing and Subscribe to the Analyst (API + MCP) plan, listed there as API + MCP. Checkout is handled securely by Stripe.
3. Open Account → API key and choose Reveal your API key. This creates your key and shows it once, so store it somewhere safe.

The Get API key button at the top of these docs starts the same flow: it signs you in or up, then opens checkout for the plan. Already subscribed? Your key is at bytetrend.io/account#/api-key once you’re signed in.

If you already have a key, that page shows Regenerate key instead. Regenerating replaces your existing key. You’ll be asked to confirm, and any integration using the old key must be updated.

If your Analyst (API + MCP) subscription ends, your key stays the same but loses API and MCP access: requests return 403 until you subscribe again. You don’t need a new key when you resubscribe.

Treat a key as a secret: it grants the access its capability allows, with no further sign-in. If you only need ByteTree MCP, you may not need a key at all — see MCP authentication.

Capability

Value	Meaning
view	In-product viewing only. Rejected from the API and MCP.
api+mcp	Programmatic access to every endpoint in this documentation and to the ByteTree MCP.

A view-only key has no programmatic access. An api+mcp key is not restricted by universe: GET /api/universes lists the whole roster, every /api/universes/<slug> path and ?universe= filter is available, and market data (prices, rates, FX, metrics, summary) is served in full. Universe slugs are the customer slugs listed on Universes; internal aliases are not accepted.

Errors

Authentication failures return a JSON error envelope:

{ "error": "<message>" }

Status	When
401 Unauthorized	No key supplied, or the key is unknown / revoked / malformed.
403 Forbidden	The key is valid but lacks the api+mcp capability — a view-only key calling the API or MCP.

The distinction matters when debugging: a 401 means the key itself was not accepted; a 403 means the key was accepted but may not use the API. Neither is returned for a universe: an unknown universe slug is a 404 on a path and a 400 on a parameter, whatever key you hold.

Which endpoints require a key

Every endpoint in this documentation requires a key, with one exception:

• GET /api/health — liveness check, always open.

Where universe scope applies

Nowhere. Earlier revisions of the API restricted some keys to a subset of universes and answered 403 for the rest; that model is retired. The key check is the only gate, and it is the same on every protected endpoint — the universe-taking endpoints included.