Bearer authentication

Public GET routes: /, /docs, /health. GET /rates and /rates/stats require an exact, case-sensitive Bearer prefix and a valid key.

Authorization: Bearer YOUR_API_KEY

Only the Authorization header is implemented. X-API-Key, query-string keys and portal session cookies are not supported by this service. Request an authorized key through GATH; this documentation does not issue keys.

Missing or invalid credentials

HTTP 401; the same response is returned for unknown protected paths before route matching:

{"success":false,"code":"unauthorized","message":"Invalid or missing API key."}

Safety

Use server-side environment variables or a secret manager and HTTPS. Do not paste keys into public clients or logs. A browser CORS preflight is not authorization.

Bearer 认证

公开 GET：/、/docs、/health。GET /rates 与 /rates/stats 要求正确密钥和大小写敏感的 Bearer 前缀。

Authorization: Bearer YOUR_API_KEY

只实现 Authorization 请求头；不支持 X-API-Key、URL 参数密钥或门户会话 Cookie。凭据需通过 GATH 授权获取，本静态文档不签发密钥。

缺失或无效凭据

HTTP 401；未知受保护路径也会在匹配路由之前得到同样响应：

{"success":false,"code":"unauthorized","message":"Invalid or missing API key."}

安全要求

仅服务端环境变量或密钥管理器保存凭据，通过 HTTPS 请求，避免公开客户端和日志泄漏。浏览器 CORS 预检不代表业务授权。