# OneTick WebAPI authentication

The symbology tool makes outbound requests to the OneTick WebAPI to resolve symbols.
`OTP_AUTH_MODE` controls how those requests are authenticated. The selected mode is
validated at startup; the server refuses to start if required credentials are missing.

#### NOTE
If you do not have WebAPI credentials, disable the Query Based group and skip this
section.  See `Enabling and disabling tool groups`.

`openid`
: OAuth2 client-credentials flow, valid for **both** OneTick Cloud and an on-prem server that
  authenticates against your own identity provider. Required variables: `OTP_CLIENT_ID`,
  `OTP_CLIENT_SECRET`, `OTP_ACCESS_TOKEN_URL`.
  
  * **OneTick Cloud** — the `onetick-mcp` entrypoint supplies defaults for
    `OTP_ACCESS_TOKEN_URL` (plus `OTP_HTTP_ADDRESS` and `OTP_WEBAPI=1`), so you normally
    only set `OTP_CLIENT_ID` and `OTP_CLIENT_SECRET`.
  * **On-prem** — the cloud defaults do **not** apply to your server. Set
    `OTP_ACCESS_TOKEN_URL` to your IdP’s token endpoint and `OTP_HTTP_ADDRESS` to your
    server’s REST gateway (with `OTP_WEBAPI=1`), in addition to `OTP_CLIENT_ID` /
    `OTP_CLIENT_SECRET`.

`basic`
: HTTP Basic authentication. Required variables: `OTP_HTTP_USERNAME`,
  `OTP_HTTP_PASSWORD`.

`none`
: No authentication. Only suitable for internal or air-gapped OneTick servers where network-level access controls are in place.

## Pointing the symbology tool at an on-prem server

For an on-prem OneTick server, always set `OTP_HTTP_ADDRESS` to your server’s REST gateway
(keep `OTP_WEBAPI=1` — pure-Python REST, no C++ libraries), then set `OTP_AUTH_MODE` and its
credentials to match your server:

```
OTP_WEBAPI=1
OTP_HTTP_ADDRESS=https://<your-onetick-host>:<port>

# openid — OAuth2 against your own IdP
OTP_AUTH_MODE=openid
OTP_ACCESS_TOKEN_URL=https://<your-idp-host>/.../token
OTP_CLIENT_ID=...
OTP_CLIENT_SECRET=...

# basic — HTTP Basic auth
OTP_AUTH_MODE=basic
OTP_HTTP_USERNAME=...
OTP_HTTP_PASSWORD=...

# none — no auth (rely on network-level controls)
OTP_AUTH_MODE=none
```

Set only the block for the mode your server uses. Consult your OneTick administrator for the
gateway URL and which auth method it requires.

See `Configuration` for the full variable reference.