Skip to main content
David authenticates every request with an API key passed in the X-API-KEY header. There are no cookies, OAuth flows, or signed requests, just the header.
Treat your API key like a password. Send it only over HTTPS and never embed it in client-side code or commit it to source control.

​
Getting a key

Your API key is available from the dashboard. If you don’t have access yet, contact founders@davidhf.com.

​
The API key header

Every data endpoint requires a valid key. The only unauthenticated path is the /health check. If the header is missing or invalid, David returns 401:

​
Rate limits

Requests are rate limited per key over a rolling 60-second window. Every response carries the current state in its headers: When you exceed the limit, David returns 429:
Back off and retry after the window resets (at most 60 seconds).
Watch X-RateLimit-Remaining and throttle proactively rather than waiting for a 429. If you need a higher limit for large backtests, contact founders@davidhf.com.

​
Next steps

Errors & rate limits

Status codes and how to handle them.

API overview

Base URL, conventions, and shared parameters.