# Authentication

Every `/v1` operation requires either a user access token issued by OddsFinder sign-in (`Authorization: Bearer <jwt>`) or an OddsFinder customer API key (`X-API-Key`). Effective access is the intersection of the caller's permissions, the client's scopes, the organization's grants, source rights and territory and time restrictions; a denied restriction is a `403 not-entitled` problem naming the restriction. Because the body depends on the credential, every response carries `Cache-Control: private, no-store` and `Vary: X-API-Key, Authorization`: no shared cache may store or reuse it.

- `Authorization: Bearer` (http): A user access token (JWT) issued by OddsFinder sign-in, validated for its signature, issuer, audience and expiry.
- `X-API-Key` (apiKey): An OddsFinder customer API key issued to an API client of your organization; it can be revoked and is limited to its scopes.