Developers

Authentication

Every API — REST, GraphQL and MCP — uses OAuth 2.1 bearer tokens. Integrations use the client credentials grant with a Client ID and Client Secret you create in the dashboard.

1. Create credentials

Sign in at app.algonexus.trade → Developer → Create client. Pick the narrowest scopes you need. The secret is shown once; only a hash is stored. You can rotate or revoke at any time.

Scope	Allows
`read`	GET endpoints: portfolio, orders, ideas, reports, brokers
`write`	Non-trading changes, e.g. generating a report
`trade`	Proposing trades and approving orders — still subject to your policy, risk gate and kill switch
`mcp`	Using the MCP server from AI assistants

2. Get an access token

curl -s -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials -d "scope=read" \
  https://api.algonexus.trade/oauth/token
# → {"access_token":"eyJ…","token_type":"Bearer","expires_in":3600,"scope":"read"}

3. Call the API

curl -s -H "Authorization: Bearer $ACCESS_TOKEN" "https://api.algonexus.trade/v1/portfolio?market=US"

Python:

import httpx
tok = httpx.post("https://api.algonexus.trade/oauth/token", auth=(CLIENT_ID, CLIENT_SECRET),
                 data={"grant_type": "client_credentials", "scope": "read"}).json()["access_token"]
print(httpx.get("https://api.algonexus.trade/v1/portfolio", params={"market": "US"},
                headers={"Authorization": f"Bearer {tok}"}).json())

Discovery

Authorization server metadata: https://api.algonexus.trade/.well-known/oauth-authorization-server
Protected resource metadata (MCP clients): https://api.algonexus.trade/.well-known/oauth-protected-resource
OpenAPI: https://api.algonexus.trade/openapi.json · GraphQL: https://api.algonexus.trade/graphql · MCP: https://api.algonexus.trade/mcp

Limits and protection

Tokens live 60 minutes. Request a new one; there are no refresh tokens for client credentials.
Rate limits per IP and route (default 300/min; token endpoint 30/min). Exceeding them returns 429 with Retry-After.
Anonymous write endpoints (signup, login, contact) require a proof-of-work bot challenge: GET /v1/challenge, find the nonce, send X-AN-Challenge.
Admin APIs are never available to API clients. Credential management requires a signed-in human.