Authentication

The server authenticates to Delta's API with an API key + secret. You never paste credentials into the AI model. They are supplied once at install time — through the bundle's form, your editor's masked prompt, or your client's config file — and read into the server at startup.

From v0.6.0 there is a second place they can live: one file the server keeps for every client on the machine. Where the key goes below covers both, and which one wins when you use both.

Which tools need what

If you only want market data, skip key creation entirely. For account reads, a Read Data key is enough. Create a Trading key only if you want the assistant placing orders.

A key registers the account and trading tools together, so the tool count your client displays tells you whether credentials arrived, not what they may do:

The two setup tools are in both rows because nothing gates them, which is why the first row is 16 and not the 14 market-data tools on their own.

The trading tools are listed with a Read Data key as well. Delta rejects what they send: UnauthorizedApiAccess - API key lacks permission for this endpoint.

DELTA_MCP_DEBUG adds one more on top of whichever row you are on — get_debug_status, which reports where the debug log is being written.

Create your API key

Where the key goes

There are two places a key can live, and they are read in a fixed order.

Your client's own config is read first: the bundle's install form, VS Code's masked prompt, or an env block in a config file. This is what the install builder fills in when you type a key into it.

The shared file is read second:

~/.delta-exchange-mcp/config.env

Every MCP client on the machine reads it, so a key set there works in Claude Desktop, Cursor, Claude Code and the rest at the same time. The server creates the file the first time it runs, owner-only, with instructions inside it, and prints the path in its startup line.

A value your client sets always wins. Leaving a field empty in your client means "not answered" and falls through to the file. Getting this backwards is a real failure mode with a confusing symptom, so it has its own troubleshooting entry.

Three ways to fill the shared file

All three write the same file. Pick one.

In the conversation. Ask your assistant to connect your account and a form appears inline:

Connect my Delta Exchange account

It asks which site the key came from, what the assistant may do with it, then the key and the secret. What you type goes straight to the file. It is not part of the conversation and the assistant cannot read it, because the form runs in its own frame. This needs a client that renders in-chat forms: Claude Desktop and the Codex desktop app do today. On any other client nothing appears and you get the instructions instead. See setup_credentials.

At a terminal, which works on every client:

uvx delta-exchange-mcp login

It prompts with the input hidden and checks the key against Delta before saving anything.

By hand. Open the file and fill in the three lines already waiting in it:

DELTA_API_KEY=your-key-here
DELTA_API_SECRET=your-secret-here
DELTA_MCP_ENV=india_prod

The terminal and by-hand routes normally need your client restarted afterwards. The in-chat form usually needs neither: a saved key registers the account and trading tools in the running server and tells the client its tool list changed, so first-time setup, environment changes and key rotation all work in the conversation you are already in. The trading tools follow the key, so saving one that carries Trading permission arms them in the same session.

Choosing the key permission

The permission on the key decides whether the assistant can trade. No setting here changes that, and Security explains why it is the boundary that holds.

Grant Read Data and the assistant reads your account while Delta rejects every order it sends. Grant Trading and it places real orders from the moment the key is saved, with no rehearsal, no size cap and no confirmation step. Delta requires an IP whitelist entry on a Trading key.

Environment variables

Where your keys live

Your credentials stay on your machine. Which file holds them depends on how you installed the server:

Whichever path you used, the rest is the same:

• Read into the server subprocess as environment variables at launch.
• Used to sign requests sent directly from your machine to Delta's API, with HMAC-SHA256.
• Never sent to the AI model or any Delta server beyond the trading API.

More on the security model in Security.