Header auth
Prefer X-API-Key: YOUR_KEY; Authorization: Bearer is also accepted. Keep X-Request-Id from responses for support.
Documentation
Authentication & API Keys
Every REST and WebSocket call needs a valid API key. This topic covers headers, multi-env keys, common failures, and safe storage.
Per-environment keys
Create separate keys for dev, staging, and production. Rotate and revoke in console immediately if leaked.
Security rules
Never ship keys in public frontend or git. Inject via env or a secrets manager; apply IP/region limits when available.
Common failures
401 usually means missing/invalid key; 403 often means market or scope denied; 429 is quota/RPM. See the errors topic.
Next steps
Validate with /api/v1/market/quote, then WebSocket. Guide: /guides/rest-api-authentication.