# Authentication and keys

- **No key**: every read endpoint works without one at 100 lookups a day per IP (current price plus 30 days of history, single cards and search). Good for trying it.
- **Free key**: log in with your email at https://tickermint.cards/developers#keys (a code, no password, no card), create a key, done. 1,000 lookups a day, 90 days of history, CSV and Google Sheets ranges, your own 300 requests a minute. The key form asks where the prices will appear (a URL, or "not public").
- **Paid keys**: Developer, API Pro, API Business and API Platform subscribers get a key by email after checkout (buy at https://tickermint.cards/developers#plan without an account; the checkout email becomes the login).

## Sending the key

```http
GET /products/517045/prices HTTP/1.1
Host: api.tickermint.cards
X-API-Key: tm_live_...
```

`?key=tm_live_...` works too (Google Sheets, Excel), but prefer the header. Use the env var `TICKERMINT_API_KEY` in code and `.env.example`:

```sh
# .env.example
TICKERMINT_API_KEY=   # free key: https://tickermint.cards/developers#keys
```

Keep keys server side: call the API from a server route, a serverless function or a bot process, never from browser JavaScript. Each answer reports usage in `X-Quota-Limit`, `X-Quota-Remaining`, `X-Quota-Reset` (Unix seconds), `X-Quota-Period` and `X-Quota-Plan`.

Revoke or rotate keys on https://tickermint.cards/developers#keys. Up to 5 keys on Developer, 25 on API Platform.