## Token Authentication

All API endpoints require an `Authorization` header with a bearer token.

### Header format

```
Authorization: Token <your-token-hex>
```

### Example

```bash
curl -H "Authorization: Token abc123def456" \
  https://i-gaming.tools/api/v1/providers/pragmatic-play/
```

### Token lifecycle

- Tokens do not expire by default.
- Keys are created and revoked from your dashboard at [/account/](/account/), which also shows what you have spent this month.
- Key management is done from the browser, not with a key: a leaked key cannot revoke your other keys or mint itself a replacement.
- Each token is scoped to one user account.

### Error responses

| Code | Meaning |
|------|---------|
| 401  | Missing or invalid token |
| 402  | Quota exhausted (monthly free tier or paid balance depleted) |
| 429  | Technical rate limit exceeded (requests/minute) |

See [Rate Limits](/docs/rate-limits) for quota and throttle details.