Manage API keys and MCP permissions

Open Settings → Connections. The reporter EA key and MCP authorization are separate connection mechanisms.

Rotate the reporter API key

The API key authenticates the Chart Reporter EA's reporting requests. Regenerating it replaces the profile's old key.

1. Choose Regenerate in the API Key section only when ready to update connected terminals.
2. Copy the replacement into the reporter EA's API-key input on every MT5 terminal using that Chart Reporter account.
3. Keep the EA attached and MT5 running. Check Experts/Journal for authentication errors and confirm terminal last-seen updates.
4. If a terminal stops reporting after rotation, check for a stale key before generating another one.

Do not send the key to support, paste it into chat, or place it in a screenshot. Rotation can interrupt reporting until terminals are updated; there is no promised automatic recovery of all history during that gap. See Install the EA and Troubleshoot missing data.

Connect an MCP client

MCP is available with Sovereign access, including qualifying trial access. The Connections panel shows whether your account can enable it.

1. Enable MCP and choose the displayed token lifetime: 30, 90 or 180 days.
2. Add the HTTP endpoint https://mcp.chartreporter.com/mcp to your client's MCP configuration using its supported setup flow.
3. Complete the browser authorization flow, check the Chart Reporter account and consent details, and approve only a client you intend to connect.
4. Ask the client to run whoami first. Verify the returned account and hubs before requesting trade data.

The current server exposes account-scoped read tools for profile/hubs, trades, statistics, events, screenshot metadata, patterns, strategies and sessions. Its OAuth scope is mcp:full; it does not provide separate per-tool consent switches. It does not place broker orders. Treat access to trading history as sensitive even when tools are read-only. Client features and screenshot-byte access can differ from metadata support.

Expiry, denied access and revocation

If authorization expires, reconnect through the client and complete sign-in/consent again. For denied access, confirm the intended account, effective Sovereign entitlement and the MCP enabled state. An EA API key will not fix an MCP OAuth error.

Use Disable MCP in Connections to turn off access. Also remove/disconnect the integration in the client when you no longer need it. Do not share bearer tokens or browser authorization codes. If disabling or enabling fails repeatedly, use troubleshooting and report the visible status without credentials.