Docs/Getting started/Authentication

Authentication

Pass your key in the x-api-key header.

Authenticate by sending your API key in the x-api-key header (or Authorization: Bearer <key>).

curl https://www.quanaris.com/v1/token/C7heQqfNzdMbUFQwcHkL9FvdwsFsDRBnfwZDDyWYCLTZ/overview \
  -H "x-api-key: qnr_live_…"

Public vs keyed endpoints

Public — all /v1/token/* reads, market & discovery, search. These work with or without a key today; passing a key identifies your tenant and applies your plan's rate limits instead of the anonymous per-IP bucket (every response carries RateLimit-* headers — see Errors & rate limits and Plans).
Keyed — account (/v1/me, /v1/keys) and subscriptions (/v1/tokens/register, …). These return 401 unauthorized without a valid key.

A presented key must be valid. If you send an API key that is invalid or revoked — via x-api-key, ?key= on /udf, or a Bearer value with the qnr_live_ prefix — you get 401 unauthorized on every endpoint, public reads included, so a typo'd key fails loudly in development instead of silently browsing as anonymous and surprising you in production. Omitting the key entirely keeps public reads anonymous as before.

Key hygiene

Keys are shown once at creation and are otherwise unrecoverable. The prefix is qnr_live_. Rotate from the dashboard; a revoked key stops working immediately.

Never ship a live key in client-side code. Proxy keyed calls through your backend.

← PreviousQuickstart Next →Making requests