## TL;DR

Putting the key in a query parameter named apikey or similar. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1.

## Fix

1. Putting the key in a query parameter named apikey or similar.
   Expected: You get the expected result; the problem is gone.
2. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter).
   Expected: You get the expected result; the problem is gone.
3. Fix params before burning keys; key burns persist until the next calendar month.
   Expected: You get the expected result; the problem is gone.

## When to use

- You are setting up or using this Brave Search API auth feature.
- The symptom matches: X-Subscription-Token header, not Bearer.

## When NOT to use

- Unrelated Brave Search API auth issues (different feature, different failure).
- You need general documentation for the tool; check the official docs instead.

## Compatibility

Reported against Brave Search API auth.

## Variant phrasings

### X-Subscription-Token header, not Bearer

## Why it happens

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys.

## Edge cases

- If your error message differs even slightly, this is probably a different issue; search the exact text.
- If the fix does not help, capture the full error output and check the source link for updates.