Authentication
Send a token on every request:
GET /v1/stocks/TCS/quote HTTP/1.1Host: api.tapetide.comAuthorization: Bearer tpt_rt_...Token types
Section titled “Token types”| Token | Prefix | Where it comes from | Use it for |
|---|---|---|---|
| Personal token | tpt_rt_ |
Created by you at tapetide.com/settings | Scripts, servers, notebooks, agents |
| Access token | tpt. |
Issued by Tapetide sign-in (OAuth) to an MCP client | Short-lived; you rarely handle it directly |
Both are accepted by the REST API and the MCP server. A personal token works until you revoke it in settings.
One account, one quota
Section titled “One account, one quota”REST and MCP share the same account and the same quota. A REST request costs exactly what an MCP tool call costs, and a token created for one works on the other. See Rate limits and quota.
Failures
Section titled “Failures”| Status | error.code |
Meaning |
|---|---|---|
| 401 | authentication_required |
No Authorization: Bearer header was sent. |
| 401 | invalid_token |
The token is unknown, expired or revoked. Create a new one in settings. |
401 responses carry WWW-Authenticate: Bearer realm="tapetide" and are never charged.
Keeping tokens safe
Section titled “Keeping tokens safe”- Store tokens in environment variables or a secret manager, not in code or notebooks you share.
- Use one token per application so you can revoke one without breaking the others.
- Browser code exposes its token to anyone who opens dev tools. Call the API from a server you control, or use the playground for experiments.