Is the reporter API key the same as an MCP access token?

By Chart Reporter Reviewed 2 min read

The short answer

The reporter API key and MCP OAuth authorisation serve different connections. The EA key authenticates terminal reporting; the assistant's MCP connection authorises account-scoped journal reads. Using one credential in the other's setup does not establish the intended access.

Draw the two data directions

The reporter runs in MT5 and sends journal data to Chart Reporter. Its configured API key identifies the reporting account. An assistant uses the MCP endpoint to request journal data already stored in that account after completing the supported authorisation flow.

This distinction explains two common failures. A terminal with an outdated reporter key can stop reporting while an assistant still reads older journal history. An assistant with expired authorisation can fail even while the EA continues sending fresh records. Diagnose the affected connection rather than changing both indiscriminately.

Use the correct recovery procedure

For an EA authentication problem, verify the current key in the reporter inputs and update every terminal after rotation. Check the WebRequest allow-list and terminal status as separate requirements. Repeated key regeneration can make it harder to identify which terminal uses the active replacement.

For MCP access, confirm the intended account, effective entitlement, enabled state and client authorisation. Reconnect through the browser consent flow when necessary. Pasting the EA key into an assistant conversation is not the documented way to solve an OAuth error and unnecessarily exposes a reporting credential.

Keep secrets out of review material

An operational note can record when a rotation or reconnection occurred without including the credential itself. A support report can include visible error text, terminal last-seen time and version information. Crop or redact screenshots that show keys, tokens or unrelated account details.

Treat each connection as something with its own lifecycle: enabled, working, expired or revoked. Verify recovery using existing records and identity information before asking for a complex analysis. A clear separation makes it easier to identify a reporting gap, an access failure or a simple history-filter issue without granting broader access than the task needs.

Sources and further reading