**02** Guides

# API key and headers

One key per client, in one header. The key works from any country and any server.

## The key in a header

Every data request sends the key in the `X-API-Key` header. We keep [only a hash of the key](https://apiauto.space/en/privacy/#keep); a lost key is rotated in the bot — the old one works for 24 more hours and the quota is not reset.

curl:

```bash
curl -s "https://api.apiauto.space/v1/usage" \
  -H "X-API-Key: $APIAUTO_KEY"
```

Without a key or with a wrong one the answer is `401 unauthorized`; every code is in [API error codes](https://apiauto.space/en/docs/errors/).

## The key stays on the server

The API does not allow browser requests (CORS is off): a key in page code would be visible to every visitor. A site or a bot calls the API from its own server and shows clients its own pages.

## Response headers

| Response header | Meaning |
| --- | --- |
| `X-Quota-Limit` | The period quota: cars a month (requests a day on the demo). |
| `X-Quota-Remaining` | How much is left. |
| `X-Quota-Reset` | When the quota renews, ISO 8601 UTC. |
| `X-RateLimit-Limit` | Requests per second on the plan. |
| `X-RateLimit-Remaining` | Left in the current second. |
| `X-RateLimit-Reset` | Seconds until the counter resets (1). |
| `Retry-After` | On 429 and some 503s: seconds to wait before retrying. |
| `X-Data-Age-Seconds` | The age of the market copy in seconds. |

## How to get a key

1. **Open the bot** [@apiautospace_bot](https://t.me/apiautospace_bot?start=demo) in Telegram and press Start.
2. **Take the demo** One day, 100 requests, all three markets and the change feed — no card.
3. **Save the key** The key comes in a message of its own and is shown once.

[Get a test key](https://t.me/apiautospace_bot?start=demo)

---

Page: https://apiauto.space/en/docs/auth/