Agents and API keys
Software reaches your Terminal account in three ways: an API key, an app you signed in to, or a webhook. This page covers each one and how to stop it.
Agents lists everything you connected in one place. Each row has Manage, which opens the Settings screen for that row.
API keys
Create keys at API keys while you are signed in. Your email must be confirmed first. Give the key a name, such as where you will use it, and choose what it can do.
The next screen says Copy your API key now. This is the only time Terminal shows the whole key. Store it somewhere safe, such as the environment variable TERMINAL_API_KEY.
Send the key on every request, in the Authorization header. Never put it in a URL. This call reads your plan, its limits and the key itself:
curl -sS --fail-with-body "$TERMINAL_BASE/v1/account" \
-H "Authorization: Bearer $TERMINAL_API_KEY"TERMINAL_BASE is https://terminal.tokensmarketcap.com. The answer never includes your email, your name or a payment method. Read Authentication for the full key format.
Scopes
A scope is one kind of action a key may take. Every key can read. You choose the rest when you create the key.
| Scope | What it allows |
|---|---|
| read | Read alerts, rules and receipts |
| rules:write | Create and change alerts |
| destinations:write | Add and change webhooks |
Scopes cannot change after you create the key. Create a new key instead, then revoke the old one. A call outside the key's scopes answers 403 with scope_missing.
Spending caps
Each call counts toward your plan's monthly API calls. Some calls can spend credits: previews, explanations, and calls past your plan's monthly calls. Two caps limit that spend.
Each key has a Daily spending limit. It starts at $5 and goes up to $100. A day runs from midnight to midnight UTC. Set it to zero and the key never spends credits.
Your account has a Monthly API spending limit for all your keys together. It starts at $20 and goes up to $500. Change it on API keys, under API use this month.
Quotas lists each plan's calls and what happens past them.
Connected apps
An AI assistant such as Claude or ChatGPT can sign in to your account over MCP instead of using a key. Terminal asks you first, and lists what the app may do. Read MCP to connect one.
Apps you signed in to are listed under Connected apps on API keys. Each shows what it may do and when it last called. An app's calls count toward your account's API use.
Webhook and bot destinations
A webhook sends each alert to an address you choose, as a signed POST. A bot webhook sends the same alert in the format a trading bot reads. Both are set up on Alerts and quiet hours.
A key with destinations:write can add and test webhooks too. Webhooks shows each step and how to check the signature.
A bot webhook carries only your own alerts. Terminal does not choose what your bot does with them.
Revoke access
- A key. On API keys, choose Revoke on the key. Software that uses it stops working at once. You cannot undo this.
- A connected app. On the same page, under Connected apps, revoke the app. Its next call is refused.
- A webhook or bot webhook. On Alerts and quiet hours, remove it. Terminal stops sending to it.
If a key may have leaked, revoke it first. Then create a new key and update your software.
Updated Oct 24, 2026