Authentication
Every request needs an API key — a secret code that identifies you. You get one from your
ByteTrend.io account and send it with each request in the Authorization
header. A key on the API + MCP plan opens everything in this documentation: every endpoint,
every universe and the ByteTree MCP.
One exception: ByteTree MCP also accepts account sign-in. You can add it to a client by URL and sign in with your ByteTree account instead of configuring a key — see MCP authentication. The plan requirement is the same either way.
Under the hood, a key carries a capability — whether it may use the API and MCP at all — and is checked on every request. Keys do not carry a universe scope. See the Changelog for the cutover note if you integrated while the API was open.
Passing your key
Send the key in the Authorization header using the Bearer scheme:
curl https://api.bytetree.io/api/assets \
-H "Authorization: Bearer YOUR_API_KEY"The same header works for every protected endpoint and for every response format
(json, csv, toon).
Obtaining a key
API keys are issued through your ByteTrend.io account; each key is minted with a capability that matches your subscription. Treat a key as a secret — it grants the access its capability allows, with no further sign-in.
Capability
| Value | Meaning |
|---|---|
view | In-product viewing only. Rejected from the API and MCP. |
api+mcp | Programmatic access to every endpoint in this documentation and to the ByteTree MCP. |
A view-only key has no programmatic access. An api+mcp key is not restricted by universe:
GET /api/universes lists the whole roster, every /api/universes/<slug> path and
?universe= filter is available, and market data (prices, rates, FX, metrics, summary) is
served in full. Universe slugs are the customer slugs listed on Universes;
internal aliases are not accepted.
Errors
Authentication failures return a JSON error envelope:
{ "error": "<message>" }| Status | When |
|---|---|
401 Unauthorized | No key supplied, or the key is unknown / revoked / malformed. |
403 Forbidden | The key is valid but lacks the api+mcp capability — a view-only key calling the API or MCP. |
The distinction matters when debugging: a 401 means the key itself was not accepted; a
403 means the key was accepted but may not use the API. Neither is returned for a universe:
an unknown universe slug is a 404 on a path and a 400 on a parameter, whatever key you hold.
Which endpoints require a key
Every endpoint in this documentation requires a key, with one exception:
GET /api/health— liveness check, always open.
Where universe scope applies
Nowhere. Earlier revisions of the API restricted some keys to a subset of universes and
answered 403 for the rest; that model is retired. The key check is the only gate, and it is
the same on every protected endpoint — the universe-taking endpoints included.