> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trdrs.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request to the key-scoped surface carries a bearer key.

Every request to the key-scoped surface carries a bearer key:

```http theme={null}
Authorization: Bearer trdrs_sk_...
```

Tenant keys are issued per commercial contract and resolve to your tenant principal on our side.
They are server-to-server credentials. Never put one in a browser, a mobile app, or anything else
an end user can inspect. If a key ships to a client once, assume it is public and ask for a
revoke.

## Browser access to market data

Market data routes can also admit browser requests from origins you register with us. This is how
a chart in your web app reads history and quotes without your backend proxying every request.

Two rules keep this safe:

* only market data routes admit registered origins. Trading and account routes always require
  the key, from your server, with no exceptions;
* if a request carries an `Origin` header, that origin must be on your allowlist even when a
  valid key is attached. A bearer excuses a missing origin, never an untrusted one.

## Partner authentication

Partner keys use the same header and the same token shape, and they reach `/api/partner/` only.
Tenant keys are refused there. See Keys for the full permission model.