> ## Documentation Index
> Fetch the complete documentation index at: https://docs.veilroute.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, headers, and how errors are reported.

## API keys

Every request is authenticated with an API key sent in the `X-Api-Key` header:

```bash theme={null}
curl -X POST https://web.veilroute.dev/api/v1/sensor \
  -H "X-Api-Key: $VEILROUTE_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
```

The **Akamai BMP** service also accepts the key as a bearer token, which some HTTP clients make easier to configure:

```bash theme={null}
curl -X POST https://bmp.veilroute.dev/api/v1/sensor \
  -H "Authorization: Bearer $VEILROUTE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"app":"com.example.app"}'
```

> [!WARNING]
>
> Keys are **per product** — an Akamai Web key does not work on Akamai BMP, and vice versa.
> Keep keys server-side. Never embed them in a browser bundle, mobile app, or public repository.

## Rate limiting

Each key has its own request budget. When you exceed it, the API returns `429`. Back off and retry;
the limit is a short rolling window, not a permanent block. See [Rate limits](/rate-limits).

## Error responses

Errors return a JSON body with a single `error` field and the matching HTTP status. Error messages
are intentionally generic — they never reveal **why** a request failed, so an attacker cannot use
them to probe the service. Use the status code to decide how to react, and your own logs/request id
for debugging.

```json theme={null}
{ "error": "request failed" }
```

See [Errors](/errors) for the full list of status codes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.