Authentication
TickerLayer uses one API key for both REST and the public WebSocket upgrade. Keys are validated server-side on every request. Never commit raw keys to source control.
API keys
Each account can have up to 5 active API keys, created, renamed and revoked in the dashboard. All keys belong to the same account, so they share its rate limits, monthly quota and WebSocket connection allowance; an extra key does not add capacity.
REST
| Method | Send the key as | Use |
|---|---|---|
| Header | x-api-key: <YOUR_API_KEY> | Preferred: keeps the key out of server and proxy URL logs. |
| Query parameter | ?apiKey=<YOUR_API_KEY> | Compatibility fallback; use the header for new integrations. |
cURL example
curl -sS "https://api.tickerlayer.com/crypto/symbols" \
-H "x-api-key: <YOUR_API_KEY>"Browsers & CORS
- Servers and tools
- Backend services, native apps, curl and Postman are not affected by browser CORS rules.
- Browser apps
- JavaScript in a web page can call REST only from an approved origin. Contact us to allowlist your domain.
WebSocket
Authenticate once, on the HTTP upgrade URL, with the apiKey query parameter. It is a native WebSocket server (not Socket.IO), with no in-frame handshake.
Connection URL
wss://stream.tickerlayer.com/?apiKey=<YOUR_API_KEY>Case-sensitive
The parameter name must be exactly apiKey; other spellings are rejected with 401. Upgrade-time details: WebSocket authentication.
Error codes
| Status | Meaning |
|---|---|
401 Unauthorized | Missing or invalid API key. |
403 Forbidden | The key exists but is inactive, or is not entitled for the surface (REST or WebSocket). |
All error bodies: Errors reference.