> TickerLayer documentation for AI agents and LLMs, the Markdown version of https://tickerlayer.com/docs/authentication
> REST base URL https://api.tickerlayer.com, API key in the `x-api-key` header. WebSocket wss://stream.tickerlayer.com?apiKey=YOUR_API_KEY.
> Any docs page reads as Markdown at its URL plus `.md`. Index: https://tickerlayer.com/llms.txt · Full API reference: https://tickerlayer.com/llms-full.txt

# Authentication

TickerLayer uses one API key for both REST and the public WebSocket upgrade. Keys are validated server-side on every request. Never commit raw keys to source control.

## API keys

Each account can have up to 5 active API keys, created, renamed and revoked in the dashboard. All keys belong to the same account, so they share its rate limits, monthly quota and WebSocket connection allowance; an extra key does not add capacity.

## REST

| Method | Send the key as | Use |
| --- | --- | --- |
| Header | `x-api-key: <YOUR_API_KEY>` | Preferred: keeps the key out of server and proxy URL logs. |
| Query parameter | `?apiKey=<YOUR_API_KEY>` | Compatibility fallback; use the header for new integrations. |

**cURL example**

```bash
curl -sS "https://api.tickerlayer.com/crypto/symbols" \
  -H "x-api-key: <YOUR_API_KEY>"
```

## Browsers & CORS

- **Servers and tools:** Backend services, native apps, curl and Postman are not affected by browser CORS rules.
- **Browser apps:** JavaScript in a web page can call REST only from an approved origin. Contact us to allowlist your domain.

## WebSocket

Authenticate once, on the HTTP upgrade URL, with the `apiKey` query parameter. It is a native WebSocket server (not Socket.IO), with no in-frame handshake.

**Connection URL**

```
wss://stream.tickerlayer.com/?apiKey=<YOUR_API_KEY>
```

Case-sensitive

The parameter name must be exactly `apiKey`; other spellings are rejected with `401`. Upgrade-time details: [WebSocket authentication](https://tickerlayer.com/docs/websocket/authentication).

## Error codes

| Status | Meaning |
| --- | --- |
| `401 Unauthorized` | Missing or invalid API key. |
| `403 Forbidden` | The key exists but is inactive, or is not entitled for the surface (REST or WebSocket). |

All error bodies: [Errors reference](https://tickerlayer.com/docs/errors).