> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alphaengine.trade/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API-key auth, scopes, compute units, and rate limits for public v1.

All `/v1/**` routes require an API key.

<CardGroup cols={2}>
  <Card title="Public utility" icon="activity">
    `GET /healthz` and `GET /openapi/v1.json` are public utility routes.
  </Card>

  <Card title="Protected v1" icon="key-round">
    Strategy Arena discovery, simulation, and evaluation routes require
    `x-api-key`.
  </Card>
</CardGroup>

Authenticated routes use:

```http theme={null}
x-api-key: <beta-api-key>
```

## Required scopes

<AccordionGroup>
  <Accordion title="strategy:read">
    Required for family, strategy, parameter, and market reads.
  </Accordion>

  <Accordion title="strategy:simulate">
    Required for simulation endpoints.
  </Accordion>

  <Accordion title="evaluation:run">
    Required for the evaluation endpoint.
  </Accordion>
</AccordionGroup>

## Auth failures

<AccordionGroup>
  <Accordion title="401">
    Missing or invalid API key.
  </Accordion>

  <Accordion title="403">
    Inactive key or insufficient scope.
  </Accordion>

  <Accordion title="429">
    Compute budget, rate limit, or concurrency cap exceeded.
  </Accordion>

  <Accordion title="503">
    Auth resolution unavailable.
  </Accordion>
</AccordionGroup>

## Compute budget

Default beta cost policy:

<CardGroup cols={3}>
  <Card title="Read request" icon="book-open">
    `1` compute unit.
  </Card>

  <Card title="Evaluation request" icon="chart-line">
    `1` compute unit.
  </Card>

  <Card title="Simulation request" icon="cpu">
    `10 * components.length` compute units.
  </Card>
</CardGroup>

Default shared budget is `50` compute units per second per key.

Default concurrency policy:

<CardGroup cols={2}>
  <Card title="Simulation" icon="cpu">
    `2` in-flight requests per key.
  </Card>

  <Card title="Evaluation" icon="chart-line">
    `4` in-flight requests per key.
  </Card>
</CardGroup>

The beta limiter is in-memory and per router instance. It is app-level
protection, not a globally exact distributed counter.

## Related pages

<CardGroup cols={2}>
  <Card title="API overview" icon="file-check" href="/api/overview">
    Public route groups and implemented endpoints.
  </Card>

  <Card title="Errors" icon="triangle-alert" href="/api/errors">
    Problem details and client handling rules.
  </Card>
</CardGroup>