# Authentication

## API keys

Send your key in the `x-api-key` header on every request. Keys identify your application for rate limiting and usage. Never ship a key in client-side code.

## Wallet-scoped actions

Endpoints that act for a user — creating listings or offers, claiming rewards, managing a profile — require proof that the caller controls the wallet. The planned flow is Sign-In with Ethereum: request a nonce, sign it with the wallet, exchange the signature for a short-lived token sent as `Authorization: Bearer <token>`.

Order creation itself never needs Unvault to hold a key: the user signs the order (EIP-712) and the API stores and serves it.

## Errors

- `401` — missing or invalid key or token.
- `403` — the key or token lacks the required scope.
- `429` — rate limited; see [rate limits](/rate-limits).