market
Authentication
Every request must include an API key in the X-Api-Key request header. Keys are issued
individually per integration — email [email protected] if you don't have one yet,
or if your key stops working and you suspect it was revoked.
This is not a new requirement. X-Api-Key has always been part of this contract and the
endpoint has always checked it; what changed recently is only that a rejected request now
tells you why (see the three codes below). If your integration works today, nothing here
asks you to change it.
X-Api-Key: <your-api-key>
Requests without a usable key are rejected with 401 Unauthorized before any other
processing happens. Three things make a key unusable, and each answers with its own code so
you can tell them apart without asking us — see Errors:
| Unknown, malformed or missing | 40100 — check what your client is sending |
| Expired | 40101 — the key had a lifetime and it has passed. Ask us to issue a new one |
| Revoked | 40102 — the key was deliberately stopped. Ask us before retrying with anything |
A key may carry an expiry date. If yours does, you were told when it was issued, and it stops working the moment it passes — reissuing is routine, so ask early rather than at the point of failure.