← Back to the dashboard

Ticky API docs: developer guide for the Ticky dashboard API

The Ticky dashboard has a small JSON API, described in full by the OpenAPI 3.1 spec. It powers the dashboard and the Ticky Chrome extension. It is not a public data API: there are no API keys, and a program can only reach a trader's data with that trader's own sign-in or their own Ticky install.

Authentication

Session cookie (__Host-ticky_session). Set by POST /api/v1/auth/signup or POST /api/v1/auth/login on this site. Secure, HttpOnly, SameSite=Lax, 30 days. Writes with the cookie must come from this site (the Origin header is checked).
Install token (Bearer). Each Ticky extension install has a random 64-hex token. The extension uses it for GET /api/v1/devices/status, POST /api/v1/devices/claim and PUT /api/v1/notes. Only hashes of it are stored.
Google and Microsoft sign-in run in the browser through /api/v1/auth/oauth/{provider}/start.

Endpoints

GET /api/v1/auth/providers: which sign-in options are on (public)
GET /api/v1/auth/me, POST /api/v1/auth/signup, POST /api/v1/auth/login, POST /api/v1/auth/logout, POST /api/v1/auth/onboarded, DELETE /api/v1/auth/account: the account (browser)
GET /api/v1/devices, POST /api/v1/devices/link, DELETE /api/v1/devices/{id}, POST /api/v1/devices/code: linked installs (browser)
POST /api/v1/devices/claim, GET /api/v1/devices/status: called by the extension with its install token
GET /api/v1/notes, DELETE /api/v1/notes (browser) and PUT /api/v1/notes (extension): daily habit notes

Example

curl -s https://ticky-dashboard.gazehop-site.workers.dev/api/v1/auth/providers
# {"google":true,"microsoft":false}

Versioning and deprecation

This is version 1. Paths start with /api/v1/; the unversioned /api/ paths are the same version, kept for Ticky installs already out there. Every response carries API-Version: 1, and you may send API-Version: 1 (any other value gets 400). A breaking change becomes /api/v2/. The old version then keeps working for at least 90 days and announces its end with Deprecation (RFC 9745) and Sunset (RFC 8594) headers, plus a note on this page. Adding fields or endpoints is not a breaking change.

Rate limits

Sign-up and sign-in answer with RateLimit-Policy and RateLimit headers (IETF draft-ietf-httpapi-ratelimit-headers), for example RateLimit-Policy: "email";q=10;w=900, "ip";q=50;w=900 and RateLimit: "email";r=7;t=812, "ip";r=49;t=812: q tries per w seconds, r left, t seconds until reset. A used-up limit answers 429 with Retry-After in seconds. Other endpoints have no published rate limit.

Limits

Sign-in: 10 tries per email and 50 per IP per 15 minutes. Notes: 4 KB each, exact shape only, at most 400 days per install. AI coach (on the main site): 30 chats and 100 chart comments a day per account.

Not available yet

No API keys, sandbox, CLI, SDK or MCP server: Ticky holds traders' habit data, and opening it to outside programs is a product and privacy decision that hasn't been made. Questions: contact. Every page here is also available as Markdown (send Accept: text/markdown), and agents can start from llms.txt.