Permissions and trading
| Access | Meaning |
|---|---|
| Read-only | This app can read public markets and your email address, balance, portfolio, positions, and order history through Juhus MCP. |
| Can trade | Includes read access and exposes order placement, cancellation, and amendment to a compatible client. |
A client may request trading, but the Juhus consent toggle starts off. You can approve a requested read trade connection as read-only. Adding trading later requires a new authorization from the client.
A successful new authorization for the same OAuth client_id replaces its prior Juhus connection. Old access and refresh credentials stop working. A new dynamically registered client_id is a distinct connection and remains separately revocable.
Juhus applies the same balance, fee, market-status, responsible-gaming, trading-pause, idempotency, and rate-limit enforcement as web and API orders. See Trading, Fees, and Responsible trading limits.
Tool responses include explicit integer-cent fields for arithmetic and exact two-decimal EUR fields for display. For example, balanceCents: 500 and balanceEur: "5.00" represent €5.00.
An MCP market buy must use budgetCents, not quantity. The budget is a fee-inclusive maximum: total fill cost plus taker fees cannot exceed it. Market sells continue to use quantity, and priced limit buys may continue to use quantity.
Placing an order requires a Juhus browser confirmation. Changing price, increasing quantity, or amending a scheduled order also requires browser confirmation. Cancellation and a non-scheduled in-place quantity reduction may execute directly after the AI client’s own tool approval.
A Juhus confirmation URL is valid for five minutes, works only for the same signed-in Juhus user, and shows the exact operation summary before approval. Approval authorizes only the exact request shown. It does not grant standing permission for later trades.
Modern MCP clients continue the approved request through an input-required retry. Legacy/stateless clients receive an opaque signed confirmationState with the confirmation URL in the error’s JSON text content and resend it unchanged with identical tool fields after approval. The error omits structuredContent, so strict clients do not validate the confirmation payload against the successful order schema. The state is bound to the same tool, user, OAuth client, and exact arguments; it expires with the confirmation and is never sent to the trading API.
A market-buy confirmation always shows max_spend derived exactly from budgetCents. If the client loses a mutation response, reconcile with list_orders before retrying.
Revoke access from Juhus Account -> Connected apps . Revocation prevents future Juhus MCP requests but does not undo completed trades or cancel existing Juhus orders.