Authentication
TickerLayer uses one API key for both REST and the public WebSocket upgrade. Keys are validated server-side on every request — never commit raw keys to source control.
REST
Prefer the x-api-key header on every request. This keeps your key out of server and proxy URL logs. The API also accepts ?apiKey= on REST URLs as a compatibility fallback — use the header for new integrations.
- Preferred:
x-api-key: <YOUR_API_KEY> - Fallback:
?apiKey=<YOUR_API_KEY>
curl -sS "https://api.tickerlayer.com/crypto/symbols" \
-H "x-api-key: <YOUR_API_KEY>"Browsers & CORS
REST requests use the x-api-key header as described above. Integrations that run on a server, in a backend service, or in native apps — or that you try with tools such as curl or Postman — are not affected by browser CORS policies.
Calls made from JavaScript in a web browser are only accepted from approved origins. If you need to invoke the REST API directly from a browser-based application, contact us so we can allowlist your domain.
WebSocket
Authenticate on the HTTP upgrade URL using the apiKey query parameter. This is a native WebSocket server (not Socket.IO) — there is no separate in-frame auth handshake.
wss://stream.tickerlayer.com/?apiKey=<YOUR_API_KEY>Case-sensitive
The query parameter name must be exactly apiKey. Other spellings are rejected with 401. See WebSocket authentication for full upgrade-time behavior.
Error codes
- 401 Unauthorized — missing or invalid API key.
- 403 Forbidden — key exists but is inactive, or not entitled for the surface being accessed (REST vs WebSocket).