> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alphractal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request is authenticated with an API key sent in the X-Api-Key header.

## Sending your key

All requests to the Alphractal API require an API key. Send it in the `X-Api-Key` header:

```bash theme={null}
curl "https://api.alphractal.com/btc/market/PriceUSD?startDate=2026-01-01" \
  -H "X-Api-Key: YOUR_API_KEY"
```

A bearer token is accepted as an alternative, carrying the same key:

```
Authorization: Bearer YOUR_API_KEY
```

Requests without a valid API key are rejected.

## How to get an API key

1. Log in to your Alphractal account.
2. Navigate to the **API** section in your dashboard.
3. Generate a new API key.

Each API key is unique to your account and determines:

* Access level (plan / tier)
* Available endpoints
* Credit limits and rate limits

## Security best practices

* Treat your API key as a **secret**.
* Do not expose it in client-side code, public repositories, or frontend applications.
* Use environment variables or secure key management systems when deploying.

If an API key is compromised, rotate it immediately from the dashboard.

## Key scope and limits

* API keys are **account-based**, not asset-based.
* Usage is tracked per key: each key has its own credit balance and its own rate-limit
  window.
* A key may be restricted to a subset of metrics. Calling an endpoint outside that subset
  returns **403 Forbidden**, regardless of remaining credits.

See [API Credits](/credits) for consumption and [Rate Limits](/rate-limits) for throughput.