Authentication
Arche authenticates API requests with an API key.
API keys
Use a valid Arche API key before making data-plane requests.
Treat API keys like secrets:
- do not commit them to source control
- do not embed them in client-side applications
- rotate them if they are exposed
Required header
Send your API key on every authenticated request:
X-Api-Key: YOUR_API_KEY
Requests without a valid API key can fail with an authentication or authorization error.
Authenticated request
curl -X GET "https://api.arche.fi/v1/edgar/companies:resolve?ticker=AAPL" \
-H "X-Api-Key: YOUR_API_KEY"
Authentication failures
The schema documents 401 and 403 responses across authenticated routes.
- Handle
401as an authentication failure. - Handle
403as an authorization failure. - Log the response body and any
trace_idfield when escalating an auth issue.
Never ship Arche API keys in browser-exposed code. Keep authenticated calls on the server side or in trusted internal tooling.
Operational guidance
- Prefer server-side secret management over distributing plaintext keys to multiple operators.
- Log request identifiers, not API keys, when troubleshooting.