Authentication

Authorization: Bearer YOUR_KEY

Requests without this header return 401 Unauthorized. Invalid keys return 401 with { "error": { "code": "unauthorized" } } in the response body. See errors for the full envelope.

Confirm a key is active by requesting any tracked ticker.

curl "https://api.tickerbot.io/v2/tickers/AAPL" \
  -H "Authorization: Bearer YOUR_KEY"

A 200 indicates the key is valid. 401 indicates the key is missing or invalid; 403 indicates the key is valid but the requested capability is not included in the key's plan.

Keys are issued from the dashboard at tickerbot.io/docs. Sign up free (no card) and mint your first key from the dashboard; additional keys (for staging, CI, or per-environment isolation) are created there too.

Rate limits are per-key. Created resources — webhook subscriptions, custom signals, universes — are account-scoped: every key on the same account sees the same registry. Rotating a key never strands those resources.

Per-key rate limits and per-plan capacity (rate, webhooks, webhook cadence, custom signals) are documented in one place: tickerbot.io/pricing. Sign up free — no card — and upgrade for webhooks and higher rate limits when you need them.

• Keys are credentials. Do not commit them to source control, embed them in mobile applications, or include them in browser bundles.
• Use separate keys for staging and production environments.
• Revoke exposed keys from the dashboard. Revocation takes effect immediately.