Authentication
All /stable endpoints require API key authentication. Keys are issued and managed on the dashboard, and can be sent either as the x-api-key header or as an Authorization: Bearer header.
x-api-key header
Set your API key in the request header. This is the recommended authentication method.
x-api-key: YOUR_API_KEY
Authorization: Bearer header
For clients that cannot set a custom x-api-key header (MCP clients, some SDKs), send the key as a Bearer token. Only API keys starting with zenith_ are accepted.
Authorization: Bearer YOUR_API_KEY
block
Query string (?apikey=) is not accepted
Keys in the URL leak into access logs, Referer headers and browser history, so query-string authentication was removed in 2026-10. Requests carrying ?apikey= return 401 with a message pointing to the header forms.
https://api.zenithcode.net/stable/profile?symbol=7203&apikey=YOUR_API_KEY
warning
API keys are secrets. Never ship them in client-side code or commit them to repositories. If a key leaks, revoke it on the dashboard and issue a new one.