> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nordicfinancialnews.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key authentication, scopes, rate limits, and monthly usage quotas.

All API endpoints require Bearer token authentication using an API key.

## How to authenticate with API keys

Include your API key in the `Authorization` header on every request:

```bash theme={"dark"}
Authorization: Bearer YOUR_API_KEY
```

Generate API keys from **Settings > API Keys** in your Nordic Financial News account.

## API key scopes and permissions

API keys use scope-based access control. All scopes are enabled by default:

| Scope            | Access                                                                                                 |
| ---------------- | ------------------------------------------------------------------------------------------------------ |
| `read`           | All content (articles, stories, companies, categories, countries, exchanges, indices, sources, search) |
| `read:watchlist` | Read your watchlists and their companies                                                               |

You can restrict scopes when creating an API key to limit access.

## Rate limits and usage quotas

The API enforces hourly rate limits and monthly usage quotas per API key. Your current limits and usage are visible in your [API key settings](https://nordicfinancialnews.com/settings/api_keys).

### Rate limit headers

Every response includes headers so you can track usage proactively:

| Header                  | Description                                      |
| ----------------------- | ------------------------------------------------ |
| `X-RateLimit-Limit`     | Maximum requests per hour                        |
| `X-RateLimit-Remaining` | Requests remaining this hour                     |
| `X-RateLimit-Reset`     | Seconds until the hourly limit resets            |
| `X-Monthly-Limit`       | Your plan's monthly allowance                    |
| `X-Monthly-Remaining`   | Requests remaining this month                    |
| `X-Monthly-Reset`       | ISO 8601 timestamp when the monthly limit resets |

When either limit is exceeded, the API returns `429 Too Many Requests` with a `Retry-After` header. See [error handling](/guides/errors) for details on handling `429` responses.

<Tip>
  `304 Not Modified` responses from [ETag caching](/guides/caching) do not count against your monthly quota.
</Tip>

### What counts toward your quota

Every request that authenticates successfully counts toward your monthly quota, regardless of the response status. This includes `404`s, validation errors, and other `4xx` or `5xx` responses. Two kinds of requests are not counted:

* Requests rejected at authentication — a missing or invalid API key, a blocked IP, or a plan without API access.
* `304 Not Modified` responses from [conditional requests](/guides/caching).

The hourly rate limit counts every request that presents your API key, regardless of the response.