Generating a Terminal Key

A terminal key (MTMCP- followed by 32 hex characters) is the only credential your EA and MCP client need. You generate it from the dashboard after subscribing — there's nothing in your welcome email to copy.

Why a separate key

A terminal key is bound to exactly one MT4/MT5 terminal the first time that terminal connects with it. That binding is what stops a command from ever being routed to the wrong account and guarantees one key maps to one terminal context.

Generate one

1. Log in to your dashboard with the email you used at checkout.
2. Go to Terminal Keys → Generate New Key.
3. Copy the generated key (MTMCP- followed by 32 hex characters) somewhere safe — it's shown once.

Bind it

A freshly generated terminal key isn't usable yet — it has to be bound to a terminal first:

1. Install the MTContext Expert Advisor on the terminal you want to connect (download the .ex5/.ex4 from your dashboard, drop it into MQL5/Experts/ or MQL4/Experts/, attach it to any chart).
2. Enter the terminal key as the EA's license input and let it connect once.
3. Once the EA shows as connected in your dashboard, the key is bound — it will now work in any MCP client config.

Keep it safe

A terminal key is a durable credential. Anyone holding it can act on the bound terminal within your subscription tier's capabilities until you revoke it — the session tokens issued from it don't bound the blast radius of a leaked key. If a key is ever exposed, revoke it from Dashboard → Terminal Keys immediately; the server stops issuing new sessions for it within seconds. An MCP session that's already running keeps working until its cached session token expires (default 1 hour), then fails to refresh.

Rotation and revocation

Use this sequence when rotating credentials without downtime:

1. Generate a new key in the dashboard.
2. Update your client configuration to use the new key.
3. Verify with a read-only prompt (get_tick or get_account_info).
4. Revoke the previous key.

For emergency revocation (suspected leak), revoke first, then generate and deploy a new key immediately.

Common key errors

• 401 Unauthorized: key is invalid, malformed, or already revoked.
• 403 Forbidden: key is valid but lacks required capability for that tool.
• Terminal mismatch style errors: key is bound to a different terminal than the one currently expected.
• Works in dashboard but not in client: stale client config or wrong profile file loaded.

Troubleshooting checklist

1. Confirm the key starts with MTMCP- and has no trailing spaces.
2. Confirm your client is sending Authorization: Bearer <key> exactly.
3. Confirm terminal is connected and key binding completed at least once.
4. Restart the client to force config reload.
5. If still failing, rotate the key and test again.