Pick a client
Add the Vike data server — https://data.vike.io/mcp — to Claude Desktop, Claude Code, ChatGPT, Cursor, Gemini CLI, VS Code, or a script.
The data server is a URL every client points at: https://data.vike.io/mcp, one Streamable HTTP
endpoint carrying all 73 tools. Nothing is installed and nothing runs locally. What differs per
client is only where the configuration lives and how a credential header is spelled.
Call the server vike — the name the rest of these docs uses.
The trader server goes in the same file
Vike ships a second MCP server for the trading platform — vike-cli mcp, a local process
rather than a URL — and for most clients its entry sits beside this one in the same config file
or the same CLI. It is set up on its own pages: Trader / Client setup. Give
it a different name (vike-trader) if you add both: a client keys its servers by name, so a
second vike replaces the first.
Pick your client
| Your client | How the credential is carried | Page |
|---|---|---|
| Claude Desktop | OAuth 2.1, registered automatically — no key at all | Claude Desktop |
| Claude Code | X-API-KEY header on claude mcp add --transport http | Claude Code |
| ChatGPT | OAuth 2.1 where the surface offers it, else an X-API-KEY header | ChatGPT |
| Cursor | X-API-KEY in mcp.json's headers object | Cursor |
| Gemini CLI | --header "X-API-KEY: ..." on gemini mcp add | Gemini CLI |
| GitHub Copilot in VS Code | X-API-KEY in .vscode/mcp.json, "type": "http" | VS Code |
| A script, or curl | X-API-KEY header on every POST | Raw HTTP |
The credential
Two are accepted, and they are tried in this order:
Authorization: Bearer vk_oat_...— an OAuth 2.1 access token. Clients that support Dynamic Client Registration (RFC 7591) register themselves and you approve access in a browser; no key is ever copied. This is the Claude Desktop path.X-API-KEY: vk_...— a long-lived key you create under Account → API Keys. Every client can use this.
OAuth sign-in stays on vike.io although the server is on data.vike.io: an unauthenticated call
is answered 401 with resource_metadata="https://data.vike.io/.well-known/oauth-protected-resource",
whose authorization_servers is ["https://vike.io"]. The client is sent to vike.io to sign in,
vike.io issues the token, and data.vike.io/mcp accepts it. A config that still names
https://vike.io/mcp keeps working for now, but that address is being retired: switch it to
https://data.vike.io/mcp.
The rule behind the table above: a client that speaks OAuth Dynamic Client Registration needs
no key at all, provided its redirect URI is on the server's list; everything else sends a
header. The list is claude.ai and claude.com, loopback addresses (http://localhost,
http://127.0.0.1, http://[::1], which covers CLI clients), and these exact callbacks, each
copied from the vendor's own documentation: ChatGPT
(https://chatgpt.com/connector_platform_oauth_redirect and
https://chatgpt.com/connector/oauth/{callback_id}), Cursor web
(https://www.cursor.com/agents/mcp/oauth/callback), VS Code
(https://vscode.dev/redirect) and Perplexity
(https://www.perplexity.ai/rest/connections/oauth_callback, or its enterprise.perplexity.ai
twin). A client whose redirect is not on it gets invalid_redirect_uri and uses a key. Every
client page above still works with a key.
Both credentials resolve to the same account and reach the same 73 tools. The difference that
matters later is how the hourly counter is keyed — per key for X-API-KEY, pooled per user for
OAuth. See Rate limits.
Where an API key comes from
Create one under Account → API Keys. Up to three may be active at once — the fourth is refused with a 400. You can read a key back from that page later.
Getting started walks that, and Authentication covers both credential types in full.
Verify the connection
Whichever client you set up, one prompt proves the whole path — transport, credential and tool dispatch — rather than just the config file being read:
Search for PEPE token using Vike
That calls token_search, which costs 0 credits, so a failed verification attempt costs
nothing.
If nothing happens, three checks in order:
- Is the server listed at all? Every client has a way to show its configured MCP servers. If Vike is missing, the config file was not read — usually a restart, or the wrong file.
- Is the credential reaching the server? Run the raw HTTP
tools/listcall with the same key: it either returns 73 tools or an explicit error. A bad key is HTTP 401. ⚠ Other failures arrive at HTTP 200 with the error in the JSON-RPC body, so a status-code check alone is not a test. - Did the tools load but not get used? Some clients require you to enable a server's tools
per conversation. Name the tool in your prompt — "use the vike
token_searchtool" — to force the issue.
Revoking access
- API keys — delete the key under Account → API Keys.
- OAuth clients — revoke under Account → API Keys → Connected Apps. Revocation kills every non-revoked token that client holds for your account and leaves your other connected clients alone.
Neither takes effect instantly. A validated credential is cached for 45 seconds, so a revoked key or token can keep authenticating for that window — a deliberate trade of a few seconds of staleness for not re-validating the credential from scratch on every request. Rotate by creating the new credential first, moving traffic to it, then deleting the old one.