AUTHENTICATION
Authenticate requests
Every request except the public endpoints needs an API key. Keys start with gna_live_ and belong to your account's plan.
Send your key
The API accepts both X-Api-Key and apiKey equally. Use the header for server-side requests to keep keys out of URLs and logs; the query parameter is convenient for browser tests but may be retained by browser history, proxies or analytics. Authorization: Bearer is also supported. If a request includes more than one, precedence is X-Api-Key, Authorization, then apiKey.
1. X-Api-Key header (recommended for servers)
curl "https://apis.newssearchapi.com/v1/articles?q=climate" -H "X-Api-Key: $NEWSSEARCHAPI_API_KEY"2. apiKey query parameter (browser tests)
https://apis.newssearchapi.com/v1/articles?q=climate&apiKey=YOUR_API_KEY3. Authorization header (also supported)
Useful when your HTTP client or gateway already sends bearer tokens.
curl "https://apis.newssearchapi.com/v1/articles?q=climate" -H "Authorization: Bearer $NEWSSEARCHAPI_API_KEY"Public endpoints
GET /v1/stats and GET /v1/headlines/sample need no key, so you can evaluate the data before signing up. The sample endpoint allows 30 requests per minute per IP address.
Manage keys
- Create keys in the console. The full key is shown once, so copy it straight into your secret store. We only keep a SHA-256 hash.
- Use one key per app or environment (for example "production" and "staging"). Your plan sets how many keys you can have, and request logs show which key made each call.
- Roll a key to issue a new secret and retire the old one, for example after a team member leaves.
- Revoke a key immediately if it leaks. Requests with it then fail with
apiKeyRevoked.
New, rolled and revoked keys, and plan changes, can take up to a minute to take effect everywhere.
Keep keys secret
- Store keys in environment variables or a secret manager, never in source code or Git.
- Don't call the API with your key from browser or mobile code: anyone can read it there. Call it from your backend or a serverless function instead.
- For AI agents, give the key to your tool executor or MCP client config, not to the prompt.
Authentication errors
| Status | Code | What to do |
|---|---|---|
| 401 | apiKeyMissing | Send the key in one of the three ways above. Check the environment variable is set. |
| 401 | apiKeyInvalid | Check for typos or extra spaces, and that you copied the full key. |