> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ticksupply.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secure your API requests using API key authentication

# Authentication

All Ticksupply API requests require authentication using an API key. This guide covers how to create, use, and manage your API keys.

## API key authentication

Pass your API key in the `X-Api-Key` header with every request:

```bash theme={"system"}
curl -H "X-Api-Key: YOUR_API_KEY" \
  https://api.ticksupply.com/v1/exchanges
```

<Warning>
  API keys grant full access to your account's data and subscriptions. Treat them like passwords—never share them publicly or commit them to version control.
</Warning>

## Creating API keys

Generate API keys from your [dashboard](https://app.ticksupply.com/api-keys):

<Steps>
  <Step title="Navigate to API Keys">
    Go to **Settings** → **API Keys** in your dashboard.
  </Step>

  <Step title="Create a new key">
    Click **Create API Key** and give it a descriptive name (e.g., "Production Server" or "Development").
  </Step>

  <Step title="Copy the key">
    Copy the key immediately—it won't be shown again.

    <Warning>
      The full API key is only displayed once at creation. Store it securely.
    </Warning>
  </Step>
</Steps>

## Using API keys in your code

<Tabs>
  <Tab title="cURL">
    ```bash theme={"system"}
    curl -H "X-Api-Key: YOUR_API_KEY" \
      https://api.ticksupply.com/v1/exchanges
    ```
  </Tab>

  <Tab title="Python">
    ```python theme={"system"}
    import os
    import requests

    API_KEY = os.environ["TICKSUPPLY_API_KEY"]
    BASE_URL = "https://api.ticksupply.com"

    headers = {"X-Api-Key": API_KEY}

    response = requests.get(f"{BASE_URL}/v1/exchanges", headers=headers)
    response.raise_for_status()
    print(response.json())
    ```
  </Tab>

  <Tab title="JavaScript">
    ```javascript theme={"system"}
    const API_KEY = process.env.TICKSUPPLY_API_KEY;
    const BASE_URL = "https://api.ticksupply.com";

    const response = await fetch(`${BASE_URL}/v1/exchanges`, {
      headers: { "X-Api-Key": API_KEY }
    });

    if (!response.ok) {
      throw new Error(`HTTP ${response.status}: ${response.statusText}`);
    }

    const data = await response.json();
    console.log(data);
    ```
  </Tab>
</Tabs>

<Tip>
  Store your API key in environment variables rather than hardcoding it in your application.
</Tip>

## Account isolation

API keys are scoped to your account. Every API key:

* Can only access data belonging to your account
* Shares rate limits with other keys on the same account
* Has the same permissions as other keys on your account

<Note>
  All subscriptions and exports created with any of your API keys are visible to all your API keys.
</Note>

## Authentication errors

If authentication fails, you'll receive a `401 Unauthorized` response:

```json theme={"system"}
{
  "error": {
    "code": "unauthenticated",
    "message": "Invalid or missing API key"
  }
}
```

The response also includes an `X-Request-Id` header you can reference when contacting support.

Common causes:

| Issue                      | Solution                              |
| -------------------------- | ------------------------------------- |
| Missing `X-Api-Key` header | Add the header to your request        |
| Invalid API key            | Check for typos or regenerate the key |
| Deleted API key            | Create a new key in the dashboard     |

## Security best practices

### Use environment variables

Never hardcode API keys in your source code:

```bash theme={"system"}
# Set environment variable
export TICKSUPPLY_API_KEY="your_api_key_here"
```

```python theme={"system"}
import os
api_key = os.environ["TICKSUPPLY_API_KEY"]
```

### Rotate keys periodically

Create new keys and retire old ones regularly:

1. Create a new API key in the dashboard
2. Update your applications to use the new key
3. Verify everything works correctly
4. Delete the old key

### Use separate keys for environments

Create different keys for development, staging, and production:

* **Development**: Test locally without affecting production data
* **Staging**: Validate changes before production deployment
* **Production**: Use only in your production environment

### Monitor key usage

Review your API usage regularly in the dashboard to detect:

* Unexpected spikes in requests
* Requests from unknown IP addresses
* Failed authentication attempts

## Request tracing

Every API response includes an `X-Request-Id` header:

```
X-Request-Id: req_abc123def456
```

Include this ID when contacting support about specific requests.

<Tip>
  Log the `X-Request-Id` from responses in your application for debugging and support purposes.
</Tip>

## Next steps

<CardGroup cols={2}>
  <Card title="Rate Limiting" icon="gauge" href="/guides/rate-limiting">
    Understand rate limits for your account
  </Card>

  <Card title="Error Handling" icon="circle-exclamation" href="/guides/error-handling">
    Handle authentication and other errors
  </Card>
</CardGroup>