Authentication and permissions
Send a personal token in the HTTP header:
Authorization: Bearer YOUR_SENTINET_TOKENTokens authenticate your programs. The API reference also lets you test requests through the documentation’s first-party proxy. Your token stays in memory for this visit; ordinary browser requests with personal tokens are refused by the API.
Use your signed-in account in the reference
Section titled “Use your signed-in account in the reference”The terminal and documentation share your Sentinet login in the same browser. Your active tokens appear above the reference automatically. Choose one, then send the request from the editor. Use Refresh connection after creating or revoking a token.
If you are signed out, choose Sign in to Sentinet. You return to the documentation in the same tab after signing in. When your access credential expires, the terminal renews it using your existing login and returns you to the page you were reading.
Signing in to the installed app or a different browser does not sign you in to Safari.
Existing token secrets cannot be recovered: the server stores only their hashes. The reference uses your shared session and the selected token’s identifier instead. Every request checks ownership, expiry, revocation, scopes, plan and token limits again. The shared cookie is encrypted, Secure and HttpOnly; documentation scripts receive only account metadata. Refresh credentials stay on the terminal origin. Signing out or changing accounts clears the token selection and request state. Credentials never enter code samples.
You can still enter a personal token manually without connecting an account.
Choose access by resource
Section titled “Choose access by resource”The initial customer catalogue uses three permissions:
| Resource | Read scope |
|---|---|
| Market | market:read |
| Fundamentals | fundamentals:read |
| Watchlists | watchlists:read |
These are the default selection for a new token. Remove any permission your integration does not need. No write permission is selected by default.
A scope is only one part of access: the operation must also be released for your account and included in your plan. A broad or older token cannot unlock unreleased operations. The initial catalogue covers ticker search, the latest quote, fundamentals and your own watchlists.
Connected administrators see additional operations marked Admin in the reference. Administrative operations, tracking, token management, AI execution and exports remain unavailable to personal tokens.
Internal documentation uses your shared Sentinet session and a separate Secure, HttpOnly administrator grant, valid for at most 60 seconds. The server checks your administrator role. The grant is bound to your current account; signing out or switching accounts invalidates it.
Expiry and revocation
Section titled “Expiry and revocation”Choose a limited lifetime where possible. Tokens without an expiry remain valid until revoked. Revoking a token prevents subsequent authentication; keep separate tokens for separate integrations so one can be rotated without disrupting the others.
Limits
Section titled “Limits”Limits apply per token and depend on your plan. When a request returns 429, honor Retry-After.
Rate-limit responses include X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
Do not retry writes automatically unless you can establish that repeating the operation is safe.