Authentication

Public accounts need no key. For your own accounts, create a Developer API Key and send it as a Bearer token.

Reading your own accounts needs a Developer API Key, sent as a Bearer token.

curl https://showmytrades.com/api/v1/accounts \
  -H "Authorization: Bearer smt_live_YOUR_KEY"

Without a key

Everything that concerns published accounts works with no Authorization header at all:

Endpoint or tool	Without a key
`GET /search/accounts`	yes
`GET /accounts/{slug}`, with every `include` section	yes, for published accounts
`GET /accounts/{slug}/widget`	yes, for published accounts
MCP tools `search_public_accounts`, `get_account`, `get_widget_snippet`	yes
`GET /accounts` (your list), `/trades`, `/positions`, MCP tools on your own accounts	no: `401`

A request without a key is treated as the free plan: the attribution is required, and the limit is 20 requests per minute per IP address, lower than with a key. A key that is present but wrong still gets a 401: we never fall back to anonymous when you meant to authenticate.

This is what lets an AI assistant answer "find me verified accounts under 10% drawdown" for someone who has no ShowMyTrades account at all. See the MCP server.

Creating a key

Open your dashboard

Go to Settings → Developer API Keys.

Create the key

Give it a name that says where it will run: Claude Desktop, Monday report script. When a key needs revoking, the name is all you have to go on.

Copy it immediately

The key is shown once. We store only a hash of it, so we cannot show it to you again or recover it for you, not even by asking support.

Do not confuse it with your Connection Key. The Connection Key is what your Expert Advisor uses to send data to ShowMyTrades. The Developer API Key is what you use to read data back out. They live on different pages and are not interchangeable.

Losing a key

There is no recovery. Revoke the lost key and create a new one: revoking takes effect immediately, and anything still using that key stops working at once.

The free plan includes 1 active key, Pro and Ultra up to 10. Revoked keys do not count towards the limit, so rotating a key never locks you out.

Scopes

Each key carries the permissions it was created with.

accounts:read

scope

Read the accounts and portfolios you own, including the ones you have not published.

public:read

scope

Read and search accounts that other people have published. Never touches private accounts, and never returns personal details about their owners.

Keys are created with both. A request that needs a scope the key does not have gets a 403, not a 401: the key is valid, the permission is not.

The API is free, with attribution

Creating a key and calling the API are included in every plan, the free one too. What changes with the plan is this:

	No key	Free	Pro and Ultra
Public accounts: search, read, widget	yes	yes	yes
Your own accounts, trades, positions	no	yes	yes
Attribution	Required	Required	Recommended
Requests per minute	20 per IP address	30 per key	120 per key
Active keys	none	1	10

The plan is read fresh on every request and is never stored on the key. If a Pro plan lapses, the same key keeps working on the free terms, and goes back to the Pro ones by itself when the plan is active again. Nothing is revoked and nothing needs to be recreated.

Keeping a key safe

Treat it like a password

Anyone holding your key can read everything you can, including your private accounts.

Keep it server-side

Never put a key in a web page, a mobile app or a public repository. Browsers cannot call this API cross-origin anyway, which is deliberate.

One key per integration

Separate keys mean you can revoke the one that leaked without breaking everything else.

Widget reference

Every embeddable ShowMyTrades widget with its URL, every type and every parameter: 7 iframe widgets and 11 self-updating images. Enough to write the snippet by hand, with no login and no API key.

Attribution

The API and the MCP server are free in exchange for a visible credit: Data from ShowMyTrades, with a link. What to show, where to link, and code to copy.