> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amazonomics.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, plan requirements, and authentication errors

Every REST API request needs an API key. Send the key in the `Authorization` header:

```bash theme={null}
curl "https://api.amazonomics.com/v1/periods/latest" \
  -H "Authorization: Bearer az_your_key_here"
```

## API keys

Create and delete keys at [amazonomics.com/organization/keys](https://amazonomics.com/organization/keys). Only organization owners and admins can manage keys.

Keys have these properties:

* A key starts with `az_` and belongs to your organization, not to one user.
* The dashboard shows a new key once. Amazonomics stores only a hash of it.
* A key has no expiry date. It works until you delete or disable it.

Keep keys out of your source code. To rotate a key, create a new key, move your services to it, then delete the old key.

## Plan requirements

Your organization must have an active subscription. The REST API is part of the Studio plan. If your plan does not include the REST API, requests return status 403. The [MCP server](/mcp/overview) is part of the Pro and Studio plans.

The plan also sets your data window and rate limit:

| Plan   | Monthly history | Searches per hour |
| ------ | --------------- | ----------------- |
| Pro    | Last 24 periods | 100               |
| Studio | All periods     | 500               |

## Errors

Authentication failures return one of these responses:

| Status | Code                     | Cause                                              |
| ------ | ------------------------ | -------------------------------------------------- |
| 401    | `UNAUTHORIZED`           | The key is missing, wrong, or disabled.            |
| 400    | `NO_ACTIVE_SUBSCRIPTION` | Your organization has no active subscription.      |
| 403    | `FORBIDDEN`              | The key is valid but not allowed to do the action. |

Each error body has the same shape:

```json theme={null}
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Unauthorized"
  }
}
```