> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quantoraresearch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Generate a key, understand access, and use it in requests.

Every request carries an API key in a header. There are no unauthenticated endpoints.

<Steps>
  <Step title="Get a key">
    Sign in to the [dashboard](https://app.financialdatapi.com) and create a key. It is
    shown once, so store it somewhere durable at that moment.
  </Step>

  <Step title="Send it as a header">
    Use `x-api-key`, or `Authorization: Bearer` if that suits your client better. Both
    are accepted and equivalent.

    ```bash theme={"dark"}
    curl -H "x-api-key: $QUANTORA_API_KEY" \
      "https://api.financialdatapi.com/coverage"
    ```
  </Step>

  <Step title="Confirm it works">
    `/coverage` is the cheapest authenticated call. A 200 means the key is live; a 401
    means it is missing, malformed or revoked.
  </Step>
</Steps>

<Warning>
  Never put the key in a query string. It is refused there deliberately, because query
  strings end up in server logs, proxies and browser history.
</Warning>

## What a key can read

Access is governed by two independent things:

**Your plan** decides rate limits and how much history you can reach. The free tier is
limited to recent history; paid tiers reach the full archive.

**The rights on each feed** decide whether the data can be served to you at all. A
minority of sources are licensed to us in ways that do not permit redistribution. Those
rows return no value regardless of plan, and say why rather than failing silently. See
[Sources and rights](/concepts/sources-and-rights).

## Errors

```json theme={"dark"}
{
  "error": {
    "code": "unauthorized",
    "message": "A valid Financial Data API key is required.",
    "request_id": "8efbbd33-29bc-4dc9-a89b-6b64ffd83481"
  }
}
```

Every error carries a stable `code` and a `request_id`. Quote the `request_id` when
reporting a problem; it identifies the exact request in our logs.

| Status | Meaning                                                      |
| ------ | ------------------------------------------------------------ |
| `401`  | Key missing, malformed or revoked                            |
| `403`  | Key valid, but the account or scope does not permit this     |
| `400`  | Malformed request. The message names the offending parameter |
| `429`  | Rate limited. Honour `Retry-After`                           |

<Note>
  Unknown query parameters are rejected with a 400 naming the key, rather than ignored.
  A typo fails loudly instead of silently returning unfiltered data.
</Note>