> For the complete documentation index, see [llms.txt](https://halfmoon.gitbook.io/halfmoon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://halfmoon.gitbook.io/halfmoon-docs/products/pmm-rfq/authentication.md).

# Authentication

HalfMoon PMM RFQ uses HalfMoon-issued `business` API keys for authenticated HTTP and WebSocket access.

***

## HTTP Authentication

Recommended request format:

```
Authorization: Bearer <business_api_key>
Content-Type: application/json
```

For production use, HalfMoon recommends standardizing on the `Authorization` header.

***

## WebSocket Authentication

For the orderbook stream, authentication can be provided in either of these ways:

```
wss://qe.halfmoondex.com/v1/quote/orderbook?api_key=<business_api_key>
```

or:

```
X-API-Key: <business_api_key>
```

***

## Authentication Scope

| Path Prefix         | Requires `business` API Key |
| ------------------- | --------------------------- |
| `/v1/agg-swap/*`    | yes                         |
| `/v1/quote/*`       | yes                         |
| `/v1/listing/*`     | yes                         |
| WebSocket orderbook | yes                         |

***

## Common Errors

Typical authentication failure:

```json
{
  "code": 401,
  "message": "missing api key"
}
```

Common causes include:

* missing `Authorization` header for HTTP requests
* missing `api_key` query parameter or `X-API-Key` header for WebSocket connections
* using a key that is not a `business` API key
* expired, disabled, or invalid API key

If authentication fails consistently, contact the HalfMoon service provider to confirm the active credentials and the correct environment.