Skip to main content

Authentication

All VecTrade API requests require authentication with your VecTrade API key. Use X-API-Key as the primary header for hosted/public API traffic. Some direct deployments also accept Authorization: Bearer vq_..., but X-API-Key is the stable default.

API Key Format

API keys follow the format vq_ followed by a random string:

Making Authenticated Requests

cURL

Alternative header form (when supported by your deployment):

Python SDK

TypeScript SDK

Never hardcode API keys in source code. Use environment variables or secret managers.

Key Security Best Practices

  1. Rotate regularly — Generate new keys and revoke old ones monthly
  2. Use scoped keys — Create keys with minimum required permissions
  3. Separate environments — Use different keys for dev/staging/production
  4. Monitor usage — Check the dashboard for unexpected activity
  5. Use secrets managers — Store keys in Vault, AWS Secrets Manager, etc.

Key Permissions (Scopes)

Error Responses

Missing or invalid keys return 401 Unauthorized:
Insufficient permissions return 403 Forbidden:

SDK Error Handling