# Authentication

Send your API key in the `X-API-Key` header on every `/v1` request:

```bash
curl -H "X-API-Key: $JOBS_API_KEY" "https://api.jobs-database.de/v1/jobs"
```

```python
requests.get(url, headers={"X-API-Key": api_key})
```

```javascript
fetch(url, { headers: { "X-API-Key": apiKey } });
```

## Rules

- **Header only.** A key in the URL query string is not accepted — it would end up in logs,
  proxies and browser history.
- **Keep it server-side.** Do not embed the key in web pages or mobile apps. The API sends no
  CORS headers, so browser JavaScript on another site cannot call it anyway.
- **One key, one allowance.** Usage and the per-minute rate limit are counted per key.
- `GET /healthz` is the only endpoint that needs no key.

## Authentication errors

| Status | Body | Meaning |
| --- | --- | --- |
| `401` | `{"error": "missing or invalid API key"}` | No `X-API-Key` header, or the key is unknown, revoked or was replaced. |
| `402` | `{"error": "API key inactive: trial ended or payment due"}` | The key is known but not active: a trial has ended or a payment is due. |

Neither response counts against your allowance. If you lose your key or it stops working,
[contact us](https://jobs-database.de/contact).