# Concepts Overview

This section covers the concepts that come up repeatedly across Core Platform's guides: how requests are authenticated, and how they're rate limited. It's the "attached page" for the **Concepts** group in the sidebar - clicking the group's own label lands here, separately from expanding it to reveal [Authentication](/docs/core/2026-01/guides/auth/) and [Rate limits](/docs/core/2026-01/guides/rate-limits/) underneath it.

<Callout type="note">
  Both of the pages nested under this one assume you've already completed the [Quickstart](/docs/core/2026-01/guides/quickstart/) and have a working API key.
</Callout>

At a high level, every request to Core Platform passes through the same two checks, in this order:

1. **Authentication** - is the `X-API-Key` header present and valid?
2. **Rate limiting** - has this key exceeded its tier's request budget?

A request that fails either check never reaches application code - it's rejected at the gateway with a `401` or `429` respectively, and doesn't count against your usage for the current billing period.