> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hypedexer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication & API keys

> One key for REST, WebSocket and MCP. How to send it, and what the API answers when it is missing or wrong.

Every request to the Hypedexer API is authenticated with an API key. You create and revoke keys yourself in the console at [app.hypedexer.com](https://app.hypedexer.com), see [Generate API key](/api/generate-api-key).

## Sending the key

The examples in this documentation use the `X-API-Key` header:

```bash theme={null}
curl "https://api.hypedexer.com/overview/total-fills-24h" \
  -H "X-API-Key: $HYPEDEXER_API_KEY"
```

The API accepts the key in three places. They are equivalent, pick the one your client makes easiest.

| Where | Example | REST | WebSocket |
| - | - | :-: | :-: |
| `X-API-Key` header | `X-API-Key: <key>` | yes | yes |
| `Authorization` header | `Authorization: Bearer <key>` | yes | yes |
| `api_key` query parameter | `?api_key=<key>` | yes | yes |

<Note>
  Browsers cannot set custom headers on a WebSocket handshake. From a browser, connect with `wss://api.hypedexer.com/ws?api_key=<key>`. Prefer a header everywhere else: query strings end up in access logs and browser history.
</Note>

The same key works for the [hosted MCP server](/mcp/authentication).

## When authentication fails

Both cases return HTTP `401` with a plain-text body. A WebSocket handshake without a valid key is refused with `401` before the connection opens.

| Situation | Status | Body |
| - | - | - |
| No key sent | `401` | `missing api key` |
| Key unknown or revoked | `401` | `invalid api key` |

Failed requests are not charged. The full list of error codes is in [Errors](/guides/errors).

## Keeping keys safe

* Keep keys out of client-side code and public repositories. Use an environment variable or your secret manager.
* Create one key per service or environment, so that you can revoke one without touching the others.
* Revoking a key in the console stops every request that uses it.

## Free tier

Every account can call the API for free within a monthly credit allowance, enough to test an integration end to end. When the allowance is used up, upgrade or wait for the reset (every 30 days from plan activation). Plans, credits and limits are in [Rate Limits & Pricing](/guides/rate-limits-and-quotas).

## Need help?

<Columns cols={2}>
  <Card title="Telegram" icon="telegram" href="https://t.me/EnigmaValidatorCommunity/1" />

  <Card title="Discord" icon="discord" href="https://discord.com/invite/cbKncMeZ52" />

  <Card title="Email" icon="envelope" href="mailto:contact@hypedexer.com" />

  <Card title="Twitter" icon="twitter" href="https://x.com/hypedexer" />
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.