How to send keys
Prefer X-API-Key; Bearer also works. Carry the key in WS business messages. Always keep X-Request-Id.
Guide
REST API authentication and security
All market REST/WS calls need a valid API key. Covers headers, entitlements, 401/403/429, and key hygiene.
Scopes and markets
Keys may bind scope, IP/region, and markets. 403 often means MARKET_NOT_ENABLED or SCOPE_DENIED.
Security practices
Keep keys server-side or in KMS; split by env; rotate on leak; redact logs. Never hardcode in public repos.
Checklist
Confirm market entitlement, daily quota/RPM, header spelling; map codes via /docs/errors.
Related
Full topic /docs/auth; glossary rate limits; fields /docs/api/quote.