Authentication

API Key Authentication

API keys are used to authenticate requests to the Quant Risk API. Your API key is issued when your API access is activated.

qr_live_xxxxxxxxxxxxxxxxxxxx

The qr_live_ prefix identifies a live API key.

Sending Your API Key

Include your API key in the X-API-Key HTTP header when making requests to authenticated endpoints.

X-API-Key: qr_live_xxxxxxxxxxxxxxxxxxxx

Example Request

The following example sends an authenticated request to the Quant Risk API.

curl -X POST "https://quant-risk.scratio.com/api/v1/risk/calculate" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: qr_live_xxxxxx" \
  -d '{
    "dataset_id": "ds_xxxxxx",
    "method": "monte_carlo_normal",
    "portfolio_value": 10000,
    "currency": "USD",
    "portfolio": [
      {
        "symbol": "AAPL",
        "weight": 0.6
      },
      {
        "symbol": "BTC-USD",
        "weight": 0.4
      }
    ],
    "portfolio_mode": "buy_and_hold",
    "confidence_level": 0.95,
    "time_horizon": 10,
    "simulations": 10000
  }'

API Key Security

Your API key should be treated as a secret. Anyone with access to your API key may be able to make authenticated requests on your behalf.

Recommended practices

• Store API keys in environment variables.
• Use a secret management system in production environments.
• Keep API keys on server-side infrastructure whenever possible.
• Do not commit API keys to source control.

API key visibility

For security reasons, your API key is displayed only once when it is issued. Copy and securely store your key before leaving the reveal page.