API keys in headers, clearer errors, free failed calls
What's new
Send your key in a header. Use Authorization: Bearer YOUR_TOKEN or X-API-Key: YOUR_TOKEN. A key in a URL ends up in logs and browser history, so a header is the better choice. The api_token query parameter still works, and nothing about it is being removed. If one request carries two different keys, the API refuses it with conflicting_credentials so you never get data under the wrong key.
Errors now say what to do next. A wrong chart, metric, company, or path returns a code, up to three did_you_mean suggestions, and links to the catalog and the docs page. A path the API does not serve returns a JSON 404 with endpoint_not_found instead of a web page. The error text and the HTTP status stay as they were.
Failed calls cost nothing. Only a successful response counts against your monthly allowance. A refused or failed call is free.
Renamed charts say so. A chart that moved to a new slug still answers at the old one. The response now carries Deprecation and a successor-version link next to X-Newhedge-Canonical-Slug, so you can move to the new slug on your schedule.
Browsers can call the API. Scripts running in a browser can send the Authorization and X-API-Key headers and read the response headers above.
Connect to the price WebSocket without putting your key in the URL. POST /api/v2/cable/ticket returns a ticket that works for one connection and expires after 60 seconds. Open the returned wss:// URL. Connecting with ?api_token= still works.
How to
Replace a query-string key with a header:
```bash
curl -H "Authorization: Bearer YOUR_TOKEN" "https://newhedge.io/api/v2/metrics/CHART_SLUG/METRIC_NAME"
```
Get a WebSocket ticket:
```bash
curl -X POST -H "Authorization: Bearer YOUR_TOKEN" "https://newhedge.io/api/v2/cable/ticket"
```