# Authentication

Send your API key on every data request using the HTTP `Authorization` header:

```http
Authorization: Bearer YOUR_API_KEY
```

Sign in, select a plan on the [pricing page](/pricing), then open [My Subscriptions](/subscriptions). Each subscription includes an API key. Reveal or copy the current key from its subscription page.

Production and sandbox API keys are separate. A sandbox key cannot authenticate a request to the production gateway. Paid plans on the production portal use real billing.

## Authenticate a request

With the environment variables from the [quickstart](/quickstart):

```sh
curl "$ATM_API_BASE_URL/movies?limit=1" \
  --header "Authorization: Bearer $ATM_API_KEY"
```

Do not send keys in query parameters. URLs can appear in logs, browser history, and analytics.

## Keep the key on your server

For a website or mobile application, have your backend call the API and return the data your client needs. Store the key in your server's secret manager or private environment configuration.

Do not bundle it into browser JavaScript, a public repository, a mobile binary, or a screenshot. A key embedded in a distributed app can be extracted. Apply your own access controls and request limits to the backend route that calls this API.

## Use the reference explorer

Open an endpoint in the [API reference](/api) and enter your key in its authorization control to try a request. Use your own key, and clear it before sharing your screen or device. Examples in these guides intentionally contain placeholders.

## Diagnose an authentication failure

| Status | Check                                                                                        |
| ------ | -------------------------------------------------------------------------------------------- |
| `401`  | The header is present, uses `Bearer`, and contains the complete valid key.                   |
| `403`  | Your subscription is active, payment is current, and its monthly allowance is not exhausted. |

Repeated retries will not fix rejected credentials. Check configuration first. If a key is exposed, roll it from My Subscriptions, update your server configuration, and remove the exposed key. The portal shows any overlap period for the previous key.

**Next:** [Search for a movie →](/movie-search)