Authentication

There are two ways in. Your own code sends an API key with every request, as described below. An AI agent such as Claude Code connects to the MCP server and signs in through the browser — no key in its configuration.

Create API keys in the dashboard. Public API endpoints accept either header:


Authorization: Bearer sk-…


x-api-key: sk-…

Use Authorization unless an SDK specifically expects x-api-key. Both forms identify the same account and spend the same prepaid balance.

Keep keys server-side

An API key is a spendable secret. Never include it in browser JavaScript, mobile binaries, public repositories, URLs, logs, screenshots, or support messages. Calls from a client application should pass through your backend.


const response = await fetch("https://api.api-stock.com/api/v1/catalog", {
  headers: { Authorization: `Bearer ${process.env.API_STOCK_KEY}` },
});

Rotate a key

Generate a replacement in the dashboard, deploy it, verify traffic, then revoke the old key. Revocation applies to new authenticated requests.

Authentication errors

HTTP	Code	Meaning
401	`api_key_missing`	No supported key header was sent.
401	`api_key_invalid`	The key is unknown, inactive, deleted, or belongs to a banned account.
401	`auth_required`	The request resolved no authenticated account.

Do not retry an unchanged 401 request. Correct or replace the key first.