> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sandmark.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request is authenticated with an API key sent in a header.

Send your key in the `X-API-Key` header on every request:

```bash theme={null}
curl https://api.sandmark.com/volatility/v1/assets \
  -H "X-API-Key: $SANDMARK_API_KEY"
```

A request without a valid key gets `401`:

```json theme={null}
{
  "statusCode": 401,
  "message": "Access denied due to invalid subscription key. Make sure to provide a valid key for an active subscription."
}
```

## Keys

Your subscription comes with two keys, a **primary** and a **secondary**. Both work at the same time, which
lets you rotate without downtime:

**1. Switch to the secondary key**

Deploy the secondary key everywhere you use the primary.

**2. Ask Sandmark to regenerate the primary**

The old primary stops working as soon as it is regenerated.

**3. Switch back**

Move to the new primary, then repeat the process for the secondary if you need to.

> [!WARNING]
>
> Treat your key like a password. Keep it on the server side, never in browser code or a mobile app, and
> never commit it to source control. If a key leaks, contact Sandmark and it will be regenerated straight
> away.

## What the key controls

Your key is tied to your subscription, and your subscription decides:

* which endpoints you can call (the ones in this documentation)
* how far back you can read, set by your [billing plan](https://docs.sandmark.com/concepts/history-window.md)
* your [rate limit](https://docs.sandmark.com/errors-and-limits.md#rate-limit)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.