Authentication

The tradectl API uses two authentication methods:

Session Authentication (Dashboard)

The web dashboard signs in with GitHub or Google (OAuth). After login, a session cookie is set automatically.

OAuth Flow:

1. User clicks "Sign in with GitHub" or "Sign in with Google"
2. Redirected to the provider's authorization page
3. Callback to /auth/github/callback or /auth/google/callback
4. Session cookie set, redirected to the dashboard

API Key Authentication (CLI & Integrations)

For programmatic access, use API keys.

Creating an API Key

Dashboard > Account > API Keys > Create Key (or Create a key on the Home page)

Keys use the format st_live_ followed by 32 random bytes (base62 encoded). The full key is shown once — store it securely.

Using an API Key

CLI Login

echo "st_live_<your-key>" | tradectl login

This exchanges the API key for a signed JWT license token (valid for 72 hours).

Direct API Access

curl -H "Authorization: Bearer st_live_<your-key>" \
  https://api.tradectl.com/api/cli/license/verify

Key Permissions

Permission	Description
read	Read strategies, backtests, deployments
write	Create and modify resources
deploy	Start and stop deployments
admin	Full access

Rate Limits

Tier	Requests/min
Free	60
Starter	300
Pro	1,000

Rate limit headers are included in every response:

• X-RateLimit-Limit
• X-RateLimit-Remaining
• X-RateLimit-Reset