Authentication
All VecTrade API requests require authentication with your VecTrade API key.
Use X-API-Key as the primary header for hosted/public API traffic.
Some direct deployments also accept Authorization: Bearer vq_..., but X-API-Key is the stable default.
API keys follow the format vq_ followed by a random string:
Making Authenticated Requests
cURL
Alternative header form (when supported by your deployment):
Python SDK
TypeScript SDK
Never hardcode API keys in source code. Use environment variables or secret managers.
Key Security Best Practices
- Rotate regularly — Generate new keys and revoke old ones monthly
- Use scoped keys — Create keys with minimum required permissions
- Separate environments — Use different keys for dev/staging/production
- Monitor usage — Check the dashboard for unexpected activity
- Use secrets managers — Store keys in Vault, AWS Secrets Manager, etc.
Key Permissions (Scopes)
Error Responses
Missing or invalid keys return 401 Unauthorized:
Insufficient permissions return 403 Forbidden:
SDK Error Handling