Permissions

A trading key is a permissioned key registered on the account on-chain. Its limits are part of the key itself, so they hold no matter what the agent, the MCP server or a leaked token try to do.

What a trading key can do

The chain checks every transaction signed by the key against this scope: a signature verification, a message filter (orders, leverage and transfers inside the account only), a subaccount filter (0) and a self-transfer filter (every party of a transfer must be the account itself).

Server limits

On top of the on-chain scope, the MCP server applies operator limits, for example a cap on the size of a single order on mainnet. They can change; whoami always reports the limits that apply to the session.

A session is bound to one account. To trade from another wallet, authorize the connector again from that wallet — each authorization issues its own key. An account can hold up to 5 named keys; when the limit is reached, the authorize page links to the key list so you can remove one.

Key lifetime

A key approved through OAuth carries no explicit expiry, so the chain applies its default lifetime — currently 180 days. An expired key cannot sign; the client then asks you to authorize again.

Revoking access

Removing the connector in Claude, ChatGPT or another client only deletes the client's token. The key stays registered on the account until it is removed or expires. To revoke access fully:

1. Open the web app → More → API Trading Keys.
2. Find the key — keys issued through OAuth are named mcp-agent-… after the client.
3. Remove it and confirm the signature.

From that moment the chain rejects anything the key signs, and the next MCP session for that token fails.

Troubleshooting