TRADEE
API · v1

Authentication

v1 feeds authenticate with a bearer token embedded in the URL path. There is no session cookie or Authorization header.

Create a feed token

Create an output execution in the app, then generate its feed token under Settings → Connections. Tokens start with trd_feed_, are returned only on generation or rotation, and are stored by Tradee only as a SHA-256 hash plus a display prefix. Rotation invalidates the previous token. Revocation invalidates the active token and closes open streams after revalidation.

Canonical URLs

GET/api/v1/output/feeds/{token}
GET/api/v1/output/feeds/{token}/stream
GET/api/v1/output/feeds/{token}/snapshot
GET/api/v1/output/feeds/{token}/events

Store the metadata URL as TRADEE_OUTPUT_FEED_URL, fetch it at startup, require schema_version == 1, and use the returned links. Do not reconstruct paths from an unrelated host, follow redirects to another origin, or expose any link in client-side analytics.

Secrecy

Treat the token path as a bearer secret. Keep complete URLs out of source control, analytics, browser history, support captures, and logs. Feed responses use Cache-Control: no-store and Referrer-Policy: no-referrer. Configure your public reverse proxy to redact /api/v1/output/feeds/* request paths so infrastructure access logs cannot record the token.

What is not used

These public endpoints use no browser session, cookies, CSRF token, Authorization header, or broad CORS policy.