OneTick WebAPI authentication#

The symbology tool makes outbound requests to the OneTick WebAPI to resolve symbols. OTP_AUTH_MODE controls how those requests are authenticated. The selected mode is validated at startup; the server refuses to start if required credentials are missing.

Note

If you do not have WebAPI credentials, disable the Query Based group and skip this section. See Enabling and disabling tool groups.

openid

OAuth2 client-credentials flow, valid for both OneTick Cloud and an on-prem server that authenticates against your own identity provider. Required variables: OTP_CLIENT_ID, OTP_CLIENT_SECRET, OTP_ACCESS_TOKEN_URL.

  • OneTick Cloud — the onetick-mcp entrypoint supplies defaults for OTP_ACCESS_TOKEN_URL (plus OTP_HTTP_ADDRESS and OTP_WEBAPI=1), so you normally only set OTP_CLIENT_ID and OTP_CLIENT_SECRET.

  • On-prem — the cloud defaults do not apply to your server. Set OTP_ACCESS_TOKEN_URL to your IdP’s token endpoint and OTP_HTTP_ADDRESS to your server’s REST gateway (with OTP_WEBAPI=1), in addition to OTP_CLIENT_ID / OTP_CLIENT_SECRET.

basic

HTTP Basic authentication. Required variables: OTP_HTTP_USERNAME, OTP_HTTP_PASSWORD.

none

No authentication. Only suitable for internal or air-gapped OneTick servers where network-level access controls are in place.

Pointing the symbology tool at an on-prem server#

For an on-prem OneTick server, always set OTP_HTTP_ADDRESS to your server’s REST gateway (keep OTP_WEBAPI=1 — pure-Python REST, no C++ libraries), then set OTP_AUTH_MODE and its credentials to match your server:

OTP_WEBAPI=1
OTP_HTTP_ADDRESS=https://<your-onetick-host>:<port>

# openid — OAuth2 against your own IdP
OTP_AUTH_MODE=openid
OTP_ACCESS_TOKEN_URL=https://<your-idp-host>/.../token
OTP_CLIENT_ID=...
OTP_CLIENT_SECRET=...

# basic — HTTP Basic auth
OTP_AUTH_MODE=basic
OTP_HTTP_USERNAME=...
OTP_HTTP_PASSWORD=...

# none — no auth (rely on network-level controls)
OTP_AUTH_MODE=none

Set only the block for the mode your server uses. Consult your OneTick administrator for the gateway URL and which auth method it requires.

See Configuration for the full variable reference.