Brave Search API auth: X-Subscription-Token header, not Bearer

TL;DR

Putting the key in a query parameter named apikey or similar. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1.

Fix

1. Putting the key in a query parameter named apikey or similar. Expected: You get the expected result; the problem is gone.

2. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Expected: You get the expected result; the problem is gone.

3. Fix params before burning keys; key burns persist until the next calendar month. Expected: You get the expected result; the problem is gone.

When to use

• You are setting up or using this Brave Search API auth feature.
• The symptom matches: X-Subscription-Token header, not Bearer.

When NOT to use

• Unrelated Brave Search API auth issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against Brave Search API auth.

Variant phrasings

X-Subscription-Token header, not Bearer

Why it happens

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys. Resolved: Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using the Bearer form of the Authorization header with [your key]. Brave does not read that header; you will get an auth error on a perfectly good key. 2. Putting the key in a query parameter named apikey or similar. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription. Source: https://github.com/amal-david/docingest/blob/HEAD/server/storage/docs/api-dashboard.search.brave.com/documentation_2026-02-07T03:57:54.021Z.md