Authentication - Arena API

Authorization: Bearer arena_sk_…

Clients that cannot set Authorization may send x-arena-key: arena_sk_… instead. HTTPS only.

Result	When
`401 unauthorized`	No credential. Carries `WWW-Authenticate: Bearer` with `error="invalid_request"`.
`401 invalid_token`	Key is malformed, unknown, revoked or expired. One answer for all four, on purpose.
`403 insufficient_scope`	Valid key without the scope the endpoint checks. Create a new key with it.

Scopes

Scope	Grants
`records:read`	Public records: `GET /leaderboard`, `/traders/{traderId}`, `/traders/{traderId}/picks`.
`portfolio:read`	The key owner’s own account: `GET /account`, `/portfolio`, `/portfolio/trades`, `/me/eval`, and the owner’s own `/traders/{traderId}/picks` with private picks included.
`markets:read`	Instruments and games: `GET /instruments`, `/instruments/search`, `/instruments/{ref}`, `/games`, `/games/{ref}`, and the quotes routes once venue data is on. Keys created before this scope existed lack it.
`trade:write`	Reserved. Not issued in v1 (`403 scope_not_available`). Trade with the CLI or MCP server under your own login.

GET /me and GET /usage accept any valid key. GET /status needs none.

Sessions

Key management uses a person’s session instead of a key: the website’s cookie, or a signed-in CLI’s session token as the bearer. There is no guest or anonymous access.

The playground in the API reference sends requests through Mintlify’s proxy. Use a key you can revoke, with only the scopes you need.