Authentication

Bearer tokens

Pass the key in the Authorization header. There is no query-string alternative, which keeps secrets out of access logs and browser history.

Authorization: Bearer fx_live_xxxxxxxxxxxxxxxxxx

One key covers both markets

Fiat and crypto belong to the same product, so one fx_live_ key reaches all six endpoints. Presenting it to the geolocation or global data APIs answers 403 with product_access_denied.

Live and test prefixes

• fx_live_ for production traffic.
• fx_test_ for staging and local development.
• Both consume the same plan quota, so treat test volume as real volume.

Storage and rotation

Only a prefix and a secure hash are stored, so the platform cannot show you a key again after creation. Rotating a key issues a new secret and invalidates the previous one immediately, with no overlap window.