hey, for a 401 it's almost always in the header. most APIs, even public ones, use an `Authorization: Bearer YOUR_API_KEY` header or sometimes a custom `X-API-Key`. putting it directly in the URL query string is less common for authentication these days, and generally not as secure. def check the API's docs though, they'll specify exactly how they want it.