> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.dealsignal.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.dealsignal.com/_mcp/server.

# 2026-10-22 — API key in the `X-Api-Key` header

> Send your API key in the `X-Api-Key` request header as an alternative to the `api_key` parameter.

## Added

### `X-Api-Key` header

Every endpoint that takes the `api_key` parameter now also accepts the key in the `X-Api-Key` request header:

```bash
curl -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  "https://app.dealsignal.com/api/v1/users/credit_metrics"
```

* The header is the preferred way: it keeps the key out of URLs, which can end up in logs and browser history.
* The `api_key` parameter keeps working as before, in the query string and, where documented, in the JSON body. If a request carries both, the parameter is used, even an empty `api_key=`: remove `api_key` from the URL (or the JSON body) when you switch to the header.
* On `POST /api/v1/auth/api_keys/roll`, keep sending the key in the request body.
* Authentication errors are unchanged: an unknown key returns `401` with `{ "message": "Invalid api key" }`.

See **[Authentication](/documentation/get-started/authentication)**.

---

## Changed

### Key-roll error text

The `400` that `POST /api/v1/auth/api_keys/roll` returns for a key in the query string now reads: "API key must be supplied in the request body or the X-Api-Key header, not as a query string parameter, for this endpoint." Keep sending the key in the request body on this endpoint, and match on the status code, not the text.

---

## Notes for clients

* Integrations that can set request headers (HTTP clients, workflow tools) can move the key from the URL to `X-Api-Key`.