Authentication

The OneTick MCP server has two independent authentication layers:

1. MCP server authentication — controls who can connect to the MCP server; uses OIDC/OAuth2 SSO. Disabled by default — enable for any deployment exposed beyond localhost.

2. OneTick WebAPI authentication — controls how the MCP server authenticates to the OneTick WebAPI for symbology lookups. Only relevant if the symbology tool is enabled.

The two layers are configured and operated independently.