> ## Documentation Index
> Fetch the complete documentation index at: https://platform.trendlinelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Send your key in the `Authorization` header on every request:

```
Authorization: Bearer tl_live_...
```

A key is `tl_live_` followed by 43 characters (letters, digits, `-` and `_`). The secret is shown once,
when the key is created; afterwards only its last four characters are shown.

## Scopes

| scope | grants |
| - | - |
| `market:read` | every market-data route: events, search, prices, order books, candles, trades, opportunities |
| `account:read` | your own balances, positions, orders and fills; refused at creation while account reads are not enabled |

`trade` is reserved and refused at creation. `GET /public/v1/key` needs a valid key and no scope.

## Limits on a key

* An IP allowlist of up to 20 CIDR ranges. A request from outside it answers 403 ip\_not\_allowed.
* A lifetime of at most 365 days; a key past its `expires_at` answers 401 unauthorized.
* Keys per account: at most 5 active at a time.

## Access

API access is free and granted on request: choose **Request API access** on the
[API keys page](https://trendlinelabs.ai/developer), and we enable it for your account. Every granted account is on
the same free plan; `GET /public/v1/key` shows its `limit` per `window_s`.

* Creating a key without granted access answers 403 access\_not\_granted.
* If access is withdrawn, the account's existing keys answer 403 access\_not\_granted, and its open
  streams close with 4403.
* tier\_required is not sent while access is granted on request.

## Browser use

Call the API from your server. Never put a key in code that is shipped to a browser: anyone who
loads the page can read it. Besides TrendlineLabs' own web apps, the one browser origin the API
answers is the documentation site, [https://platform.trendlinelabs.ai](https://platform.trendlinelabs.ai), so its "try it" panel can send
GET requests with the key you paste there; no cookies are sent or accepted. A browser on any other
site gets no CORS headers, and its preflight answers 400.

## Failures

* No key, or a key that is unknown, revoked or expired: 401 unauthorized, with
  `WWW-Authenticate: Bearer realm="public-api"`.
* Too many failed authentications from one address: 429 rate\_limited with `Retry-After`.
* A key without the route's scope: 403 insufficient\_scope.

Revocation takes effect on every server at once.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.