MCP

MCP Authentication

Keys, permissions and limits for MCP.

• Every MCP request must carry Authorization: Bearer <key>. Requests without a valid key get HTTP 401.
• Tool discovery works with any valid key; each tool call checks its own permission and returns an error result if the key lacks it.
• MCP and REST share the 60-requests-per-minute limit per key, and appear together in Developer Settings → Usage & Activity.
• Website content and assistant prompts are treated as untrusted input. They can't change Taken's safety rules or approve trades.