> ## Documentation Index
> Fetch the complete documentation index at: https://stockcontext.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to send your API key, where keys live, and what a bad key returns.

Send your key on every request in the `X-API-Key` header.

```bash theme={null}
curl -sS "https://api.stockcontext.com/v1/tools/stock_search" \
  -H "X-API-Key: $STOCKCONTEXT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q": "AAPL"}'
```

Use exactly that header name. There is no `Authorization: Bearer` path.

## Keys

Create and revoke keys on the [dashboard keys page](https://stockcontext.com/dashboard/keys).

* The raw secret is shown **once**, at creation. Copy it before you close the dialog.
* Keys do not expire on their own; they stay valid until you revoke them.
* Revoking a key takes effect promptly, after which it returns `401`.

<Warning>
  Keep keys server-side. Do not ship them in browser bundles, mobile binaries without a backend broker, public repos, logs, screenshots, support threads, or model prompts. A leaked key can spend your whole quota until you revoke it.
</Warning>

## When a key fails

A request with no key returns `401 missing_api_key`; a request with an unknown or revoked key returns `401 invalid_api_key`. Neither is retryable — fix the header or issue a new key rather than retrying.

| HTTP | Code              | Cause                                   |
| ---- | ----------------- | --------------------------------------- |
| 401  | `missing_api_key` | No `X-API-Key` header on the request.   |
| 401  | `invalid_api_key` | The key is unknown or has been revoked. |

For the full error surface, including rate limits and refusals, see [Error codes](/docs/reference/error-codes).