Authentication

Most endpoints are key-gated: pricing, NBBO, depth, history, recommendations, arbitrage, and float data all require an API key. Send it in the Authorization header on every request. Two header forms are accepted, so most HTTP clients work unchanged:

Getting a key

Create an account, then mint a key from the API Keys tab on your account page. Keys begin with sp_live_ (or sp_test_ for test-environment keys). Your plan's rate limits and monthly quota are pooled across every key on the account, so extra keys are for isolation and rotation (e.g. one per environment), not extra throughput. You can hold up to 5 active keys per subscription; revoke any of them without affecting the others.

Public vs key-gated

Almost every endpoint is key-gated. The one exception is market health, which is open (no key) and limited by IP. See Which endpoint do I need? for the full map.

When the header is missing or wrong

In short: 401 means the key itself isn't usable (missing / bad scheme / unknown / inactive / expired / revoked); 403 means the key is recognized but the account or plan isn't entitled (inactive or expired subscription, or a feature your plan doesn't include).

Key format

Keys are prefixed by environment: sp_live_<hex> for production keys and sp_test_<hex> for test keys, followed by random hex. The prefix is shown in your account so you can tell keys apart at a glance.

Keeping your key safe

Treat the key like a password. Call the API from your server, never from client-side code where the key would be exposed. Rotate a key the moment it leaks, and keep separate keys per environment so revoking one never causes downtime.