Authentication

Every request is authenticated with an API key sent in a header.

Send your key in the X-API-Key header on every request:

curl https://api.sandmark.com/volatility/v1/assets \
  -H "X-API-Key: $SANDMARK_API_KEY"

A request without a valid key gets 401:

{
  "statusCode": 401,
  "message": "Access denied due to invalid subscription key. Make sure to provide a valid key for an active subscription."
}

​

Keys

Your subscription comes with two keys, a primary and a secondary. Both work at the same time, which lets you rotate without downtime:

1. Switch to the secondary key

   Deploy the secondary key everywhere you use the primary.

2. Ask Sandmark to regenerate the primary

   The old primary stops working as soon as it is regenerated.

3. Switch back

   Move to the new primary, then repeat the process for the secondary if you need to.

Treat your key like a password. Keep it on the server side, never in browser code or a mobile app, and never commit it to source control. If a key leaks, contact Sandmark and it will be regenerated straight away.

​

What the key controls

Your key is tied to your subscription, and your subscription decides:

• which endpoints you can call (the ones in this documentation)
• how far back you can read, set by your billing plan
• your rate limit