---
title: "Authentication"
description: "Bearer tokens for the Tapetide API, how to create them, and how they relate to the MCP server."
canonical: "https://developers.tapetide.com/authentication/"
---

# Authentication

Send a token on every request:

```http
GET /v1/stocks/TCS/quote HTTP/1.1
Host: api.tapetide.com
Authorization: Bearer tpt_rt_...
```

## Token types

| Token | Prefix | Where it comes from | Use it for |
| --- | --- | --- | --- |
| Personal token | `tpt_rt_` | Created by you at [tapetide.com/settings](https://tapetide.com/settings) | Scripts, servers, notebooks, agents |
| Access token | `tpt.` | Issued by Tapetide sign-in (OAuth) to an MCP client | Short-lived; you rarely handle it directly |

Both are accepted by the REST API and the MCP server. A personal token works until you revoke it in settings.

## One account, one quota

REST and MCP share the same account and the same quota. A REST request costs exactly what an MCP tool call costs, and a token created for one works on the other. See [Rate limits and quota](/rate-limits/).

## Failures

| Status | `error.code` | Meaning |
| --- | --- | --- |
| 401 | `authentication_required` | No `Authorization: Bearer` header was sent. |
| 401 | `invalid_token` | The token is unknown, expired or revoked. Create a new one in settings. |

401 responses carry `WWW-Authenticate: Bearer realm="tapetide"` and are never charged.

## Keeping tokens safe

-   Store tokens in environment variables or a secret manager, not in code or notebooks you share.
-   Use one token per application so you can revoke one without breaking the others.
-   Browser code exposes its token to anyone who opens dev tools. Call the API from a server you control, or use the [playground](/playground/) for experiments.