> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.wealthatlas.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.wealthatlas.com/_mcp/server.

# Authentication

All Partners API endpoints require an API key passed in the `x-api-key` header.

## Getting your API key

API keys are provisioned by the WealthAtlas team. Contact [support@wealthatlas.com](mailto:support@wealthatlas.com) or reach out to your account manager to get one.

Each API key is scoped to a single team and has access to that team's data, lists, networks, and credit balance.

## Using your API key

Include the `x-api-key` header in every request:

#### cURL

```bash
curl -X GET https://api.wealthatlas.com/v1/partners/test \
  -H "x-api-key: YOUR_API_KEY"
```

#### Python

```python
import requests

headers = {"x-api-key": "YOUR_API_KEY"}
response = requests.get(
    "https://api.wealthatlas.com/v1/partners/test",
    headers=headers,
)
print(response.json())
# {"status": 200, "message": "OK"}
```

#### JavaScript

```javascript
const response = await fetch(
  "https://api.wealthatlas.com/v1/partners/test",
  { headers: { "x-api-key": "YOUR_API_KEY" } }
);
const data = await response.json();
console.log(data);
// { status: 200, message: "OK" }
```

## Verifying your key

Use the `GET /test` endpoint to verify your API key is valid. It returns `200 OK` if the key is recognized and linked to an active team.

## Key expiry

A key may carry a deactivation date, set by the WealthAtlas team when the key is issued or later. The key keeps working **through** that date (UTC) and is rejected from the following day with `401 Unauthorized`:

```json
{"detail": "API key expired on 2026-08-01. Contact WealthAtlas to issue a new key."}
```

This is deliberately distinct from an unrecognized key, which API Gateway rejects with `403 Forbidden` before the request reaches us. An expired key is never charged credits. Contact support to have a new key issued.

Once the WealthAtlas team next updates an expired key, API Gateway stops accepting it too, and from then on it gets the `403 Forbidden` of a revoked key (below) instead of this `401`.

## Revoked keys

If a key needs to stop working straight away, for example because it may have been exposed, the WealthAtlas team revokes it. API Gateway then rejects it with `403 Forbidden`, the same response as an unrecognized key, and it is never charged credits. For a short time after a key is revoked, a request may instead get `401 Unauthorized` with this body:

```json
{"detail": "API key has been disabled. Contact WealthAtlas to issue a new key."}
```

## Security best practices

* **Never expose your API key in client-side code.** API calls should be made from your server.
* **Rotate keys** if you suspect they've been compromised. Contact support to issue a new key.
* Store keys in environment variables or a secrets manager, not in source code.

## Rate limits

The Partners API enforces the following rate limits:

| Limit               | Value |
| ------------------- | ----- |
| Requests per second | 10    |
| Burst limit         | 10    |

These limits apply to each API key.

If you exceed these limits, the API returns `429 Too Many Requests`. Implement exponential backoff in your client.