> For the complete documentation index, see [llms.txt](https://docs.ticksights.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ticksights.com/api/authentication.md).

# Authentication

Every endpoint requires a Bearer token. Send it in the `Authorization` header:

```
Authorization: Bearer YOUR_API_KEY
```

Your token is the licence key of your Ticksights subscription. It is tied to your tier, which is what decides your rate limits - there is nothing to configure beyond sending the header.

A missing or malformed `Authorization` header returns `401` with `{"error": "Missing or invalid Authorization header"}`. A well-formed header carrying an unknown or revoked key returns `401` with `{"error": "Invalid token"}`. Both mean the request was not counted against your quota.

Keep the token server-side. It is not scoped to a domain and anyone holding it can spend your quota, so it does not belong in a browser or a mobile app.