> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Base URL: https://api.eventory.ai. Send your API key in the apikey header. Market Data and Live Availability calls cost credits, pings included; GET /usage is free, so use it to test a key. Costs per endpoint: https://eventory.ai/docs/credits-and-access.md

# API key authentication

> One API key, sent in the apikey header, for every API.

Every request to `https://api.eventory.ai` must carry your API key. The gateway
authenticates it, checks that your key is granted the API you are calling, and strips
the credential before forwarding the request internally. Downstream services never
see your key.

## Sending the key

Put the key in the `apikey` header:

```bash theme={null}
curl -s https://api.eventory.ai/usage -H "apikey: $EVENTORY_API_KEY"
```

The `api_key` query parameter also takes the key. Prefer the header: a key in a query
string ends up in proxy and server logs. The `Authorization` header and the `token`
query parameter carry Eventory login tokens, not API keys: an API key sent there is
rejected with `401 invalid_credentials`.

For the WebSocket stream the key goes on the upgrade request, the same way. Browsers
cannot set custom headers on a WebSocket, so the stream is meant for native clients
or a backend proxy. See [Connecting to the stream](/docs/stream/connecting.md).

## Getting a key

Keys are issued with an Eventory plan. Every key starts with access to the watchlist
and `/usage`; Market Data and Live Availability are enabled per account. The
Notifications API is not part of any plan: access is granted separately to a limited
number of partners.
See [Credits & access](/docs/credits-and-access.md) for how to tell what your key can call.

## Keeping it safe

* **Never ship a key in client-side code.** Anyone who can read your page or app can
  read the key and spend your credits. Call the API from your backend.
* **Store it in an environment variable**, not in source control.
* **Rotate a key you suspect has leaked.** Use **Rotate key** under **Settings → API
  Settings** in the Eventory dashboard. It revokes the old key, which can keep working
  for up to five minutes.
* **Use TLS only.** Plain `http://` and `ws://` are not accepted.

## What goes wrong

| Status | `code` | Meaning |
| - | - | - |
| `401` | `unauthenticated` | No credential was sent. Most often an empty shell variable. |
| `401` | `invalid_credentials` | A key was sent and rejected. Wrong or revoked, or sent in `Authorization` instead of `apikey`. |
| `403` | `forbidden` | The key is valid but is not granted this API. |

All three come back in the gateway's error envelope. See [Errors](/docs/errors.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.