## Protected endpoints

Protected API endpoints require authentication. The `/tools/search` endpoint is one example.

## How to authenticate

Include this header in authenticated API requests:

```plaintext
Authorization: Bearer YOUR_API_KEY
```

Replace `YOUR_API_KEY` with the key from your dashboard.

## Example request

```plaintext
curl -H "Authorization: Bearer YOUR_API_KEY" "https://api.useagents.site/tools/search?q=typescript%20authentication%20sdk"
```

## Authentication errors

When authentication fails, the API returns specific error responses to help you troubleshoot.

### Missing API key

If you do not include the `Authorization` header on a protected endpoint, the API returns `401 Unauthorized`:

```json
{
  "error": {
    "status": 401,
    "code": "missing_api_key",
    "message": "Missing API key in the authorization header."
  }
}
```

### Invalid API key

If the key is incorrect, malformed, revoked, or otherwise invalid, the API returns `403 Forbidden`:

```json
{
  "error": {
    "status": 403,
    "code": "invalid_api_key",
    "message": "API key is invalid."
  }
}
```

## Best practices
- Store API keys securely and never commit them to version control.
- Rotate keys if you suspect they were exposed.
- Use separate keys for different environments or integrations when appropriate.

## Next steps
- [API Keys](/content/docs/reference/api-keys/index.html) to create and manage keys
- [Errors](/content/docs/api-reference/errors/index.html) to understand other failure responses