> ## Documentation Index
> Fetch the complete documentation index at: https://docs.legend.trade/llms.txt
> Use this file to discover all available pages before exploring further.

# Connector permissions

> Read and execution scopes, mainnet-only grants, OAuth credentials, and revoking access.

## Account and network

Legend connector grants are bound to a main account on `hyperliquid_mainnet`. The connector has no paper or testnet mode. Trading-enabled access can change real positions and incur losses, fees, funding, and liquidation risk.

## Preview access

MCP access additionally requires the server-side `ai-connectors-enabled` feature flag. The production preview is limited to Legend employees. Disabling access blocks new approvals, token exchange, refresh, and subsequent MCP requests once the flag configuration reaches the server. Direct Trading API access has its own separate gate.

## Scopes

| MCP scope                  | Permission                                                    |
| -------------------------- | ------------------------------------------------------------- |
| `legend:read`              | Read account data and prepare a supported order review link   |
| `legend:read legend:trade` | Also invoke supported execution tools on the trading endpoint |

These MCP scopes are distinct from the underlying Trading API key scopes, `trading:read` and `trading:write`. The server checks both the OAuth grant and its associated account credential. A read-only grant cannot acquire trading permission by calling the other endpoint.

Neither endpoint provides withdrawals or transfers. No tool accepts an arbitrary wallet signer or a caller-selected account override.

## Consent and confirmation

The OAuth flow opens Legend for sign-in and permission approval. It uses authorization code flow with PKCE S256. Access tokens expire after one hour. Refresh tokens rotate, have a maximum lifetime of 30 days for the grant, and reuse of a consumed refresh token revokes that token family.

Approving execution permission authorizes subsequent supported tool calls. The MCP server does not enforce a separate on-site confirmation for every execution call. A host may provide additional confirmation UI; do not assume that UI exists in every integration.

The `prepare_order` tool is different: it creates a review link without submitting an order. You can open the link, inspect the values, and separately submit through Legend's trade form.

## Revocation

Revoke the associated API key in Settings → Trading to stop future API and MCP use of that credential. Disconnecting the connector in an assistant is a separate host action. Revocation does not close existing positions, cancel resting orders, or reverse fills. Manage those separately in Legend.

Keep keys and OAuth tokens secret. Never provide a wallet private key to an assistant. See [API authentication](/api-reference/trading/authentication) for key creation and revocation details.