---
title: Authentication
description: Every request is authenticated with a Bearer API key. Learn the difference between test and live keys and how errors are shaped.
sidebar:
  label: Authentication
  order: 2
---

Every endpoint under `/v1/*` requires an API key, sent as a Bearer token:

```
Authorization: Bearer <key>
```

Requests without a valid key receive `401 Unauthorized`.

## Key types

| Prefix | Type | Behavior |
| --- | --- | --- |
| `ik_test_...` | Test | Returns deterministic sample data. Never touches the live database. Never counts against your daily quota. |
| `ik_live_...` | Live | Returns real, current data. Counts against your plan's daily quota. |

Both key types share the exact same request/response shape — the only difference is where the data comes from and whether it's metered. This lets you build and test integrations on a test key with zero risk, then switch to a live key for production traffic without changing any client code.

## Managing keys

- Keys are created and revoked from your developer dashboard, under **API Keys**.
- A key's raw value is shown once, at creation — only a hash is stored server-side, so it can't be recovered later. If you lose a key, revoke it and create a new one.
- Revoking a key is immediate and irreversible; requests using a revoked key start failing with `401` right away.
- Your plan caps how many live and test keys you can have active at once (revoking a key frees its slot).

## Error responses

Every endpoint uses the same error shape:

```json
{
  "error": {
    "type": "unauthorized",
    "message": "Missing or invalid API key. Send \"Authorization: Bearer <key>\"."
  }
}
```

| Type | HTTP status | Meaning |
| --- | --- | --- |
| `unauthorized` | 401 | Missing, malformed, or revoked API key. |
| `invalid_request` | 400 | A parameter was invalid — e.g. an unknown `event_type`. |
| `server_error` | 502 | Something failed on our side while fetching data. |

See [Errors](/docs/errors) for the full list and how to handle each case.