# Authentication



All requests to the YouTube Transcript Platform API must be authenticated using a valid API key.

Authentication Headers [#authentication-headers]

You can authenticate using either standard Bearer token or the `X-API-Key` header:

```http
Authorization: Bearer YOUR_API_KEY
```

Or alternatively:

```http
X-API-Key: YOUR_API_KEY
```

<Callout type="warn" title="Keep your API key secret">
  Never expose your API key in client-side code, public repositories, or browser network requests. Use environment variables and server-side proxying.
</Callout>

Requests without a valid authorization token receive a `401 Unauthorized` response with a standard error envelope:

```json
{
  "error": {
    "code": "unauthorized",
    "message": "missing or invalid authorization token",
    "retryable": false
  }
}
```

***

Rate Limits & Concurrency [#rate-limits--concurrency]

API keys have default rate limits based on your account tier:

| Tier                      | Rate Limit                             | Burst Capacity     |
| :------------------------ | :------------------------------------- | :----------------- |
| **Free** (no pack bought) | 1 req/s, 100 requests per day (UTC)    | 20                 |
| **Starter ($9)**          | 300 RPM (5 req/s)                      | 50                 |
| **Popular ($29)**         | 600 RPM (10 req/s)                     | 100                |
| **Value ($79)**           | 3,000 RPM (50 req/s)                   | 300                |
| **Custom / Dedicated**    | Above 3,000 RPM by written reservation | Dedicated capacity |

<Callout type="info" title="Rate limit exceeded?">
  When you exceed your rate limit, the API returns `429 Too Many Requests` with `X-RateLimit-Limit` and a `Retry-After` header indicating seconds until reset. Free keys that use up the day's 100 requests get `429` with the code `daily_limit_exceeded` until 00:00 UTC; any credit pack removes the daily limit. See [Credits & Errors](/credits) for all error codes.
</Callout>