Keys and Access
The two key types on TRUE, how to create them on the MCP & API page, what each can and cannot do, and how to revoke one.
Two credentials exist. They are issued on the same page in the app (side menu, MCP & API) and they authorise different things.
| Sequencer API key | MCP key | |
|---|---|---|
| Looks like | 64 hex characters, sent as apikey_<hex> | true_sk_… |
| Where | MCP & API, tab API Management (web) or Settings, API Keys (mobile) | MCP & API, tab MCP |
| Authorises | orders, account reads and the transfers ledger on dex-prod.truefinance.ai | tool calls on app.truefinance.ai/api/v1/mcp |
| Signs | you sign every write with your own Ed25519 key; the API key only identifies the account | nothing; each write tool still needs an in app approval |
| Can withdraw | no, withdrawals are signed by the account owner wallet | no |
| Lifetime | until revoked | 90 days by default, 365 max, 5 per user |
Sequencer API key
Pick a delegated signer for a bot rather than your owner key: it can trade the account without being the key that owns it. The raw key is shown once and only its hash is stored, so save it when it appears.
What you are shown is 64 hex characters. What you send is apikey_ followed by those characters. The sequencer routes Authorization: Bearer … by prefix: apikey_ is API key auth, anything else is parsed as a JWT and fails with 401 invalid token format.
Revoke from the same screen, or revoke the delegation at the venue with DELETE /v1/accounts/delegated_keys/{public_key}.
MCP key
Scopes: read (portfolio, prices, news, watchlist, points) and trade:execute (orders, agents, copy trading; each order still needs an in app approval, and leveraged orders never auto approve). The Connected Apps tab shows which assistant holds which grant and lets you cut it.
What a leaked key can do
A leaked sequencer key can place, modify and cancel orders on your account until you revoke it. It cannot withdraw and cannot change the owner. A leaked MCP key with trade:execute can propose trades, each of which still needs your approval in the app; with read it can see balances and positions. Revoke first, then rotate.
Planned
An IP allowlist per key (requests from other addresses are refused, not rate limited), tiers with higher allowances for market makers, and API key authentication on the WebSocket. See Limits and Security.