Bargo Congress Trades Api Authentication

generated: '2026-08-09'
method: searched
source: openapi/bargo-congress-trades-api-congress-trades-openapi.yml
docs:
  - https://www.bargo.ai/free-apis/congress
  - https://www.bargo.ai/free-apis/dash
description: >-
  Authentication for the Bargo Congress Trades API is OPTIONAL, which is the
  single most important fact about it: the OpenAPI top-level security array
  leads with an empty requirement, so anonymous callers are served at a lower
  quota rather than rejected. A free key — no card, self-serve — raises the
  quota and is the only way to call the Congress MCP endpoint's tools. Three
  interchangeable credential presentations are declared; Bargo's own agent skill
  ranks them.
summary:
  types: [apiKey, http]
  api_key_in: [header, query]
  oauth2_flows: []
  required: false
  anonymous_access: true
  preferred_scheme: ApiKeyHeader
schemes:
  - name: ApiKeyHeader
    type: apiKey
    in: header
    parameter: X-Api-Key
    description: Optional free Bargo API key.
    preferred: true
    sources:
      - openapi/bargo-congress-trades-api-congress-trades-openapi.yml
  - name: BearerAuth
    type: http
    scheme: bearer
    bearerFormat: Bargo API key
    description: Optional free Bargo API key as a Bearer token.
    preferred: false
    sources:
      - openapi/bargo-congress-trades-api-congress-trades-openapi.yml
  - name: QueryToken
    type: apiKey
    in: query
    parameter: token
    description: Optional free Bargo API key for clients that cannot set headers.
    preferred: false
    caution: >-
      A credential in a query string is logged by proxies and browser history.
      Bargo scopes this deliberately — its documentation says to use ?token=
      only for connector UIs (Claude/ChatGPT app connectors) that cannot set a
      header, and its own agent skill instructs agents to prefer X-Api-Key.
    sources:
      - openapi/bargo-congress-trades-api-congress-trades-openapi.yml
credentials:
  - id: free-api-key
    prefix: fak_
    issued_by: https://www.bargo.ai/free-apis/dash
    cost: free
    card_required: false
    rotatable: true
    authorizes:
      - The Congress Trades REST API at https://www.bargo.ai/free-apis/congress/v1
      - The focused Congress MCP endpoint at https://www.bargo.ai/free-apis/congress/mcp
    does_not_authorize:
      - Bargo's full market-intelligence MCP server at https://www.bargo.ai/mcp
  - id: bargo-mcp-token
    prefix: swmcp_
    issued_by: 'https://www.bargo.ai (authorized account, then GET /api/mcp-token)'
    scope: out-of-scope-for-this-repo
    authorizes:
      - Bargo's full MCP server at https://www.bargo.ai/mcp
    note: >-
      Recorded only to make the boundary explicit. Bargo states the separation
      in three places — llms.txt, the MCP server card, and its published agent
      skill — precisely because the two look interchangeable and are not.
per_operation:
  - operation: getCongressApiHealth
    security: []
    note: >-
      The only operation that declares an EMPTY security array, meaning no
      credential is accepted or required at all. Every other operation declares
      401 InvalidKey and honours an optional key.
  - operations:
      - listCongressTrades
      - listCongressTradesByTicker
      - listCongressMembers
      - getCongressMember
      - getCongressTradeStats
    security: inherited
    note: >-
      Inherit the top-level requirement [{}, ApiKeyHeader, BearerAuth,
      QueryToken] — anonymous OR any one of the three key presentations.
error_behaviour:
  '401': >-
    Returned only when a key is supplied and is invalid or revoked. An absent key
    is never a 401 — it is a lower quota.
  '429': >-
    The practical consequence of staying anonymous. See
    rate-limits/bargo-congress-trades-api-rate-limits.yml
handling_guidance:
  source: https://github.com/bargo-ai/bargo-free-api-packages/blob/main/skills/bargo-congress-api/SKILL.md
  rules:
    - Prefer X-Api-Key; Bearer is also supported; use the token query parameter only where headers are impossible.
    - Never print, commit, log or return an API key.
    - Never substitute a fak_ key for a swmcp_ credential or imply the free key unlocks Bargo's main MCP service.
    - Pass keys through the environment or a secret manager, never in source.
gaps:
  - No OAuth 2.0 or OpenID Connect; /.well-known/oauth-authorization-server and /.well-known/openid-configuration both returned 404.
  - No scopes, roles or permission model — a key is all-or-nothing over a read-only surface.
  - No documented key rotation policy, expiry or revocation notification beyond the self-serve dashboard.