Authentication

Put the key in an environment variable such as BAVEST_API_KEY and send it as a header on every request. The code samples in the API reference read it from there.

curl 'https://api.bavest.co/v2/equities/profile?symbol=AAPL' \
  -H "x-api-key: $BAVEST_API_KEY"

import os, requests

resp = requests.get(
    "https://api.bavest.co/v2/equities/profile",
    params={"symbol": "AAPL"},
    headers={"x-api-key": os.environ["BAVEST_API_KEY"]},
)
resp.raise_for_status()

const resp = await fetch("https://api.bavest.co/v2/equities/profile?symbol=AAPL", {
  headers: { "x-api-key": process.env.BAVEST_API_KEY },
});

The MCP server takes the same key in the same header.

1. Sign up and confirm your email address.
2. The onboarding issues a trial key that works right away.
3. Later you find the key on the dashboard home page, together with your usage and the plans you can book.

Need a bigger trial or an enterprise plan? Write to service@bavest.co.

• Every key has a monthly call quota set by its plan. Each request counts once, MCP tool calls included.
• Each route in your plan takes 100 requests per second (burst 100) per key; monthly call volumes depend on the plan. Ask service@bavest.co for an enterprise plan.
• Which routes a key reaches also depends on its plan. A route outside your plan is refused, see the error table.

Check how much of this month's quota is left with GET /v2/account/quota. It answers usage, limit, remaining and period.

curl 'https://api.bavest.co/v2/account/quota' -H "x-api-key: $BAVEST_API_KEY"

The OpenAPI spec documents Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset on 429 responses. Read Retry-After when it is present; otherwise back off exponentially.

• Never put the key in a URL. Query strings end up in server logs, proxy logs, browser history and shared links. Send it in the header only.
• Never ship the key in browser or mobile code. Call Bavest from your server and pass the results on.
• Keep it out of repositories: load it from an environment variable or a secret manager.
• The one exception is an MCP connector that cannot set headers, see MCP authentication.

1. On the dashboard home page, open Manage keys and choose Rotate key.
2. You get a new key on the same plans. On paid plans the old key keeps working until you revoke it, so switch your apps first, then revoke the old key in the same dialog.
3. On the trial plan the old key stops working at once.

Rotate when a key may have leaked or someone with access leaves. Team members using their team's key ask the account admin to rotate it.