Authentication
Authenticate CompSniper REST requests with API keys and hosted MCP connections with OAuth.
REST API keys
Send your key as a bearer token on every /v1 request:
curl -H "Authorization: Bearer cs_live_REPLACEWITHYOURKEY" \
"https://api.compsniper.com/v1/account/usage"Create, rotate, and revoke keys from Dashboard > API keys.
API keys grant access to your account quota. Keep them server-side, load them from environment variables, and never place them in client-side JavaScript, screenshots, logs, or public repositories.
Hosted MCP OAuth
Hosted clients connect to:
https://mcp.compsniper.com/mcpThe client opens CompSniper sign-in and asks you to approve scoped access. Your CompSniper password and API keys are never shared with the client. OAuth connections can use these scopes:
| Scope | Purpose |
|---|---|
comps:read | Search and compare sold listings |
account:read | Read plan and remaining quota |
jobs:write | Start and cancel Max Mode jobs when requested |
offline_access | Refresh the approved connection |
See MCP setup for hosted and local client configuration.
Authentication failures
401 unauthorized: key missing, malformed, revoked, or incorrect.403 unauthorized: valid credential without the route's required OAuth scope.
Do not repeatedly retry either response. Correct the credential or reconnect with the required scope.