> ## Documentation Index
> Fetch the complete documentation index at: https://docs.innova-trading.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the InnovaTrading API

## API Keys

All API requests require authentication using a Bearer token in the `Authorization` header.

```bash theme={null}
Authorization: Bearer YOUR_API_KEY
```

## Getting Your API Key

<Info>
  During the beta period, you can use any string with **10 or more characters** as your API key.
  This allows you to start testing immediately without signup.
</Info>

**Example valid API keys:**

* `my_test_key_123` (16 chars)
* `developer_2024` (14 chars)
* `abcdefghij` (10 chars - minimum)

<Warning>
  **Coming Soon:** Full API key management with dashboard. For now, choose a unique key that identifies you.
</Warning>

## Using Your API Key

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.innova-trading.com/api/external/bars \
    -H "Authorization: Bearer my_test_key_123"
  ```

  ```python Python theme={null}
  import requests

  API_KEY = "my_test_key_123"

  response = requests.get(
      "https://api.innova-trading.com/api/external/bars",
      params={"symbol": "EURUSD", "timeframe": 60},
      headers={"Authorization": f"Bearer {API_KEY}"}
  )
  ```

  ```javascript JavaScript theme={null}
  const API_KEY = "my_test_key_123";

  const response = await fetch(
    "https://api.innova-trading.com/api/external/bars?symbol=EURUSD&timeframe=60",
    {
      headers: { Authorization: `Bearer ${API_KEY}` }
    }
  );
  ```
</CodeGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Never expose in client code" icon="eye-slash">
    API keys should only be used server-side. Never include them in frontend JavaScript.
  </Card>

  <Card title="Use environment variables" icon="lock">
    Store your API key in environment variables, not in source code.
  </Card>

  <Card title="Use unique keys" icon="key">
    Choose a unique key string to identify your requests.
  </Card>

  <Card title="Keep it secret" icon="user-secret">
    Don't share your API key publicly (e.g., in GitHub repos).
  </Card>
</CardGroup>

## Environment Variables

<CodeGroup>
  ```bash .env theme={null}
  INNOVA_API_KEY=my_test_key_123
  ```

  ```python Python theme={null}
  import os

  API_KEY = os.environ.get("INNOVA_API_KEY")
  ```

  ```javascript JavaScript theme={null}
  const API_KEY = process.env.INNOVA_API_KEY;
  ```
</CodeGroup>

## Error Responses

### 401 Unauthorized

Missing or invalid API key:

```json theme={null}
{
  "error": "unauthorized",
  "message": "Missing Authorization header"
}
```

```json theme={null}
{
  "error": "unauthorized",
  "message": "Invalid API key"
}
```

<Note>
  API keys must be at least 10 characters long. Shorter keys will be rejected.
</Note>

### 403 Forbidden

Valid API key but no access to the requested resource:

```json theme={null}
{
  "error": "forbidden",
  "message": "Symbol XAUUSD not allowed for your API key",
  "allowed_symbols": ["EURUSD", "GBPUSD", "USDJPY"]
}
```

## Available Symbols & Timeframes

By default, all API keys have access to:

| Symbols                        | Timeframes              |
| ------------------------------ | ----------------------- |
| EURUSD, GBPUSD, USDJPY, XAUUSD | 1m, 5m, 15m, 1H, 4H, 1D |

## Rate Limiting

API keys are rate-limited to prevent abuse:

| Limit                | Value |
| -------------------- | ----- |
| Requests/Hour        | 100   |
| Max bars per request | 1,000 |

When rate limited, you'll receive:

```json theme={null}
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Please wait before retrying.",
  "retry_after": 60
}
```

<Tip>
  Use exponential backoff when hitting rate limits. Start with a 1-second delay and double it with each retry.
</Tip>