https://api.eventory.ai must carry your API key. The gateway
authenticates it, checks that your key is granted the API you are calling, and strips
the credential before forwarding the request internally. Downstream services never
see your key.
Sending the key
Put the key in theapikey header:
api_key query parameter also takes the key. Prefer the header: a key in a query
string ends up in proxy and server logs. The Authorization header and the token
query parameter carry Eventory login tokens, not API keys: an API key sent there is
rejected with 401 invalid_credentials.
For the WebSocket stream the key goes on the upgrade request, the same way. Browsers
cannot set custom headers on a WebSocket, so the stream is meant for native clients
or a backend proxy. See Connecting to the stream.
Getting a key
Keys are issued with an Eventory plan. Every key starts with access to the watchlist and/usage; Market Data and Live Availability are enabled per account. The
Notifications API is not part of any plan: access is granted separately to a limited
number of partners.
See Credits & access for how to tell what your key can call.
Keeping it safe
- Never ship a key in client-side code. Anyone who can read your page or app can read the key and spend your credits. Call the API from your backend.
- Store it in an environment variable, not in source control.
- Rotate a key you suspect has leaked. Use Rotate key under Settings → API Settings in the Eventory dashboard. It revokes the old key, which can keep working for up to five minutes.
- Use TLS only. Plain
http://andws://are not accepted.
What goes wrong
All three come back in the gateway’s error envelope. See Errors.