THORChain Swap API Authentication
How agents authenticate against THORChain Swap (https://swap.thorchain.org): they do not.
Which credential do I need?
- Reading quotes, pools, or network state — nothing. Call https://swap.thorchain.org/mcp directly. No key, no token, no sign-in.
- Building a swap flow on the aggregator, earning affiliate fees, or embedding the widget — an
x-api-keyforhttps://api.thorchain.org/v1, issued free through the affiliate program at https://affiliate.thorchain.org after a short review. Different system, different backend.
Anonymous by design
There are no user accounts on this site. Browsing, the public MCP server, and the public REST endpoints are all anonymous and rate limited per client (60 MCP requests per 10 minutes). Wallet connection and transaction signing happen in the user's own wallet; memoless ("instant") swaps need no wallet at all. Nothing on this site can move funds, so nothing on it needs a credential.
No authorization server
This site publishes no /.well-known/oauth-protected-resource and no /.well-known/oauth-authorization-server, and that is deliberate.
MCP clients treat the presence of protected-resource metadata as "this server requires OAuth". A connector that finds it will start a sign-in flow — dynamic client registration, then an authorization-code redirect — and fail, because there is no user account here to sign in to and nothing for a token to unlock. Serving no authorization metadata is what lets a client conclude the server is open and connect on the first try.
So: if a client asks for an OAuth client ID, an API key, or a bearer token for https://swap.thorchain.org/mcp, leave the field blank. Adding the URL is the whole setup:
claude mcp add --transport http thorchain-swap https://swap.thorchain.org/mcpPartner API keys (the affiliate program)
The swap aggregator that powers this interface — https://api.thorchain.org/v1, quotes and routing across every supported provider — is x-api-key gated. Keys are free:
- Register at https://affiliate.thorchain.org with your name, email, website, and Telegram, and verify the email.
- The account is reviewed; the API key is issued once it is approved.
- The same dashboard configures affiliate and service fee splits per provider, generates the embeddable swap widget, and reports earnings.
Use that key with `@tcswap/sdk`, which takes it as the uSwap API key. The memoless API and this site's MCP server need no key at all.
Related
This page as markdown: /developers/auth.md