# Authentication: News Search API Docs

[ChatGPT ↗](https://chatgpt.com/?q=Read%20https%3A%2F%2Fnewssearchapi.com%2Fdocs%2Fauthentication%2F%20and%20help%20me%20build%20with%20the%20News%20Search%20API.)[Claude ↗](https://claude.ai/new?q=Read%20https%3A%2F%2Fnewssearchapi.com%2Fdocs%2Fauthentication%2F%20and%20help%20me%20build%20with%20the%20News%20Search%20API.)

AUTHENTICATION

# Authenticate requests

Every request except the public endpoints needs an API key. Keys start with `gna_live_` and belong to your account's plan.

## Send your key

The API accepts both `X-Api-Key` and `apiKey` equally. Use the header for server-side requests to keep keys out of URLs and logs; the query parameter is convenient for browser tests but may be retained by browser history, proxies or analytics. `Authorization: Bearer` is also supported. If a request includes more than one, precedence is `X-Api-Key`, `Authorization`, then `apiKey`.

### 1\. `X-Api-Key` header (recommended for servers)

X-Api-Key header

```
curl "https://apis.newssearchapi.com/v1/articles?q=climate"   -H "X-Api-Key: $NEWSSEARCHAPI_API_KEY"
```

### 2\. `apiKey` query parameter (browser tests)

Query parameter

```
https://apis.newssearchapi.com/v1/articles?q=climate&apiKey=YOUR_API_KEY
```

### 3\. `Authorization` header (also supported)

Useful when your HTTP client or gateway already sends bearer tokens.

Authorization header

```
curl "https://apis.newssearchapi.com/v1/articles?q=climate"   -H "Authorization: Bearer $NEWSSEARCHAPI_API_KEY"
```

## Public endpoints

[`GET /v1/stats`](/docs/reference/getStats) and [`GET /v1/headlines/sample`](/docs/reference/sampleHeadlines) need no key, so you can evaluate the data before signing up. The sample endpoint allows 30 requests per minute per IP address.

## Manage keys

-   **Create** keys in the console. The full key is shown once, so copy it straight into your secret store. We only keep a SHA-256 hash.
-   **Use one key per app or environment** (for example "production" and "staging"). Your plan sets how many keys you can have, and request logs show which key made each call.
-   **Roll** a key to issue a new secret and retire the old one, for example after a team member leaves.
-   **Revoke** a key immediately if it leaks. Requests with it then fail with `apiKeyRevoked`.

**Changes take up to 60 seconds**

New, rolled and revoked keys, and plan changes, can take up to a minute to take effect everywhere.

## Keep keys secret

-   Store keys in environment variables or a secret manager, never in source code or Git.
-   Don't call the API with your key from browser or mobile code: anyone can read it there. Call it from your backend or a serverless function instead.
-   For AI agents, give the key to your tool executor or [MCP client](/docs/mcp) config, not to the prompt.

## Authentication errors

Authentication error codes

Status

Code

What to do

401

`apiKeyMissing`

Send the key in one of the three ways above. Check the environment variable is set.

401

`apiKeyInvalid`

Check for typos or extra spaces, and that you copied the full key.