Authentication

Bearer authentication#

Authorization: Bearer YOUR_API_KEY

All documented /v1 operations require an API key. The backend checks the current account entitlement, key scopes, market access, IP allowlist and browser origin on each request. OPTIONS preflight is unauthenticated.

Key in the URL#

https://api.ohlc.io/v1/eod?symbols=XNAS:AAPL&api_key=YOUR_API_KEY

For tools that cannot set headers, such as spreadsheet functions, GET requests also accept the key as the api_key query parameter. Browser requests must use the Authorization header. If both are sent, the header is used. URLs end up in history, logs and shared documents, so prefer the header wherever you can, use a separate key for each tool, and revoke it if a URL is shared. See Excel & Google Sheets.

Manage keys#

Create and revoke keys in the account portal. Rotation supports a configured overlap deadline. Keep secrets on your server. Browser access requires an explicitly browser-enabled key and an allowed origin; CORS preflight alone does not grant access.

Portal APIs use session cookies and CSRF protection, separately from the market-data bearer API. A missing or invalid API key returns 401; insufficient scope or network permission returns 403.