Authentication
Authenticate CompSniper REST requests with API keys and hosted MCP connections with OAuth.
REST API keys
Send your key as a bearer token on every /v1 request:
curl -H "Authorization: Bearer cs_live_REPLACEWITHYOURKEY" \
"https://api.compsniper.com/v1/account/usage"Create, rotate, and revoke keys from Dashboard > API keys.
The same key can call the sold-comps endpoints and the separate Shipping Rates API when the account has the corresponding product access.
API keys grant access to your account quota. Keep them server-side, load them from environment variables, and never place them in client-side JavaScript, screenshots, logs, or public repositories.
Hosted MCP OAuth
Hosted clients connect to:
https://mcp.compsniper.com/mcpThe client opens CompSniper sign-in and asks you to approve scoped access. Your CompSniper password and API keys are never shared with the client. OAuth connections can use these scopes:
| Scope | Purpose |
|---|---|
comps:read | Search and compare sold listings |
account:read | Read plan and remaining quota |
jobs:write | Start and cancel Max Mode jobs when requested |
offline_access | Refresh the approved connection |
See MCP setup for hosted and local client configuration.
Authentication failures
401 unauthorized: key missing, malformed, revoked, or incorrect.403 unauthorized: valid credential without the route's required OAuth scope.
Do not repeatedly retry either response. Correct the credential or reconnect with the required scope.
Dashboard sign-in and 2FA
API keys authenticate API requests only. Signing in to the dashboard uses your email and password or Google, and you can add an optional second step with an authenticator app or a passkey. See Two-factor authentication. Turning it on never affects your API keys.