Authentication
Futu MCP uses OAuth 2.1 for authentication. MCP clients (such as Claude Desktop, Cursor) will automatically guide you through the authorization flow.
Authorization Flow
- AI client initiates authorization request — the client redirects you to Futu's OAuth consent page
- User authenticates and grants permissions — you log in and choose which scopes to authorize
- Client receives access token — upon consent, the client obtains a token for API calls
- Token auto-refreshes — when the token expires, the client handles refresh transparently (tokens expire after 14 days of inactivity by default)
Token Lifecycle
- Access tokens are short-lived (typically 2 hours)
- Refresh tokens are used to obtain new access tokens without re-authorization
- Access tokens can be manually revoked from the console
Scopes
During OAuth authorization, you can select the permission scopes to grant on the consent page:
| Scope | Description |
|---|---|
quote:read | Access real-time quotes, historical candlesticks, and market data |
quote:write | Manage watchlist symbols |
trade:read | Query account balance, positions, and historical orders |
trade:write | Submit and cancel orders |