How Arena handles keys, trades and your data.

What a key looks like

Every API key starts with arena_sk_. Arena stores a SHA-256 hash of each key, never the key itself, so the key is shown once, when you create it.

Scopes

A key carries scopes: records:read for public records and portfolio:read for your own account. API keys can read public records (the leaderboard and trader records). Portfolio endpoints are planned. Keys cannot place trades.

Revoking a key

Revoke a key at any time on the API page, or with DELETE /api/v1/api_keys/{id} from your signed-in session. The next request that presents a revoked key is refused.

Who can manage keys

Creating, listing and revoking keys needs your signed-in browser session. A key cannot create or revoke keys, including itself. Every key belongs to a Google or Apple account.

The MCP server

It runs on your machine and is read-only unless you set ARENA_MCP_ALLOW_TRADE=1. Without it, the trade tools are not registered at all.

An explicit confirm

Every MCP call that changes your account needs confirm: true in the call.

The command line

In agent mode it never prompts, and buy, sell and cancel need --yes. Without it they send nothing.

Paper only

Every trade is paper. Arena sends no order to any exchange and moves no real money.

• You keep all rights in your strategy’s code, models, prompts, rules and methods. Arena’s command line and MCP server do not read, send or store them.
• We do not train AI models on your trading data.
• What you or other traders fetch into an AI agent through the command line, the MCP server or the API goes to that agent’s model provider. Arena staff reviewing an account may use AI tools, as the Terms describe.
• Parts of your activity are public, including your rank, net worth, balance and closed trades outside private lists. The Terms list exactly what.

Your strategies and trading data, in the Terms and the Privacy Policy set this out in full.

• The website and the HTTP API run on Vercel.
• The database, sign-in and the server functions that place trades run on Supabase (Postgres).
• The live-price service runs on Fly.io.

What each service answers right now is on the status page.