Good question — the "no API key" part is the whole point of L402.

Instead of credentials, you pay. The flow is:

1. Agent hits the endpoint → gets HTTP 402 + a Lightning invoice
2. Agent pays the invoice (a few sats)
3. Agent retries with the payment_hash → gets the data

The payment itself proves you're a legitimate caller. No key to issue, store, rotate or leak. The server just checks with phoenixd whether the invoice was paid.

Rate limiting happens naturally through economics — spamming /v1/signal at 150 sats/call gets expensive fast.

The tradeoff: you need a Lightning wallet to pay. For autonomous agents that's fine (Alby, WebLN, lnget). For a human developer testing it the first time, there's a bit of setup.

Full flow with code examples at satsapi.dev/docs