Guides / Authentication

Authentication

Every request is authenticated with an API key. We issue accounts on request; you log in to the developer console and create keys yourself. Plans and limits belong to the account, not to the key.

Key types

API key types
Key	Used with	Who can create it	Active keys per account
`ck_live_…`	Data API `https://api.chickstockfi.com/openapi/v1`	Accounts with a Data API plan (PoC · Launch · Business · Scale · Enterprise)	Paid tiers 3 · PoC 2
`ck_pers_…`	PRO API `https://api.chickstockfi.com/openapi/pro/v1` and the MCP server	Accounts with a PRO plan (Data · Ask · Bundle)	2
`ck_mcp_at_…`	MCP server	Issued automatically when an AI tool connects over OAuth (access token 1 hour, refresh token 30 days). You never create it yourself.	20 connections

Request headers

Send the key in one of two headers. If both are present, X-API-Key is used. Keys in the query string are not accepted.

Samsung Electronics · 005930

http

GET /openapi/v1/news?symbol=005930 HTTP/1.1
Host: api.chickstockfi.com
Authorization: Bearer ck_live_xxxxxxxxxxxxxxxx

# or
X-API-Key: ck_live_xxxxxxxxxxxxxxxx

Key scope

Keys for one API do not work on the other.

A Data API key (ck_live_) on the PRO API returns 401 WRONG_KEY_SCOPE. The MCP server is the exception: a Data API key connects there and gets the Data API tools (see MCP).
A PRO API key (ck_pers_) on the Data API returns 401 UNAUTHORIZED.
Unknown or revoked keys return 401 INVALID_KEY on both APIs.

Accounts and plans

We issue an account after reviewing your access request. There is no self sign-up; log in to the developer console with the account ID and password we send you.
PoC is a trial of every endpoint at the trial limits of a target tier (Launch · Business · Scale) for 7 days by default (the term can be adjusted by agreement); without a target tier it is Launch. When it ends, every key on the account stops with 403 POC_ENDED. After an extension or a full contract, the same keys work again.
Paid tiers (Launch · Business · Scale · Enterprise) and PRO plans are applied to the account once the contract is confirmed. Keys you have already created pick up the plan immediately.
The daily call quota is per account, so all keys on the account share it. The Data API per-minute limit is counted per key. See Rate limits.

Storing keys

The full key is shown only once, when you create it. We store only its SHA-256 hash, so a lost key cannot be shown again; create a new one.
Use keys on your server only. Keep them out of browser code, mobile app bundles and public repositories. Add leak-scanning rules for the ck_live_ and ck_pers_ prefixes.
In logs and support emails, include only the key prefix shown in the console (for example ck_live_8fA2c1…), never the full key.

Rotation and revocation

Rotate in the console creates a new key with the same name and scope and revokes the old key on the spot. Requests with the old key get 401 INVALID_KEY immediately.

To switch keys without downtime, stay within your active key cap and follow these steps.

Create a new key in the console (up to 3 active keys on a paid tier, 2 on PoC, 2 for the PRO API).
Deploy the new key and confirm requests succeed.
Revoke the old key. A revoked key cannot be restored.

If a key may have leaked

Rotate or revoke it in the console right away. If you suspect unexpected traffic, send the time and the key prefix to help@alpsoft.io.

AI tools such as Claude and ChatGPT can connect to the MCP server with OAuth 2.1 instead of a key. The only scope is mcp; the account's PRO plan decides which tools are available. See MCP for the setup steps.