diff --git a/references/api/api-keys.mdx b/references/api/api-keys.mdx
index d8e9562..0c136f4 100644
--- a/references/api/api-keys.mdx
+++ b/references/api/api-keys.mdx
@@ -65,6 +65,10 @@ Already hitting a limit? See [Handling Rate Limits](/references/api/api_core_con
 
 ## How to Use an API key
 
+<Warning>
+Quote requests that set a `referrer` must be authenticated: pass your API key in the `x-api-key` header on `POST /quote` and `POST /quote/v2`. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`.
+</Warning>
+
 ### HTTP requests
 
 Pass the key in the request headers on every request:
diff --git a/references/api/api_core_concepts/handling-errors.mdx b/references/api/api_core_concepts/handling-errors.mdx
index be11ca6..d62d75f 100644
--- a/references/api/api_core_concepts/handling-errors.mdx
+++ b/references/api/api_core_concepts/handling-errors.mdx
@@ -39,6 +39,7 @@ These are known validation and routing issues that developers should gracefully
 | `SOLANA_TX_TOO_LARGE`                         | The compiled Solana deposit transaction exceeds Solana's 1232-byte wire limit and cannot be signed or broadcast. The response `message` reports the measured size and how many bytes it lands over. See [Solana Support](/references/api/api_guides/solana#transaction-size-optimization). |
 | `SWAP_IMPACT_TOO_HIGH`                        | The swap's price impact exceeds acceptable thresholds.                     |
 | `UNAUTHORIZED`                                | The user is not authenticated or lacks valid authorization.                |
+| `UNAUTHORIZED_QUOTE`                          | The quote request includes a `referrer` but no valid `x-api-key` header.   |
 | `UNSUPPORTED_CHAIN`                           | The specified chain is not supported by the platform.                      |
 | `UNSUPPORTED_CURRENCY`                        | The specified currency is not supported for input or output, or the token pair cannot be priced. |
 | `UNSUPPORTED_EXECUTION_TYPE`                  | The execution type used is not supported for fee estimation or execution.  |
diff --git a/references/api/changelog.mdx b/references/api/changelog.mdx
index 5016f6c..9ef5ea9 100644
--- a/references/api/changelog.mdx
+++ b/references/api/changelog.mdx
@@ -13,6 +13,10 @@ description: "Record of breaking changes, deprecations, and notable additions to
 
 **Replacement** — use [`POST /quote/v2`](/references/api/get-quote-v2) to request a quote and follow the returned steps to execute it. The Quote API covers bridging, swapping, and calling through a single unified surface, and is the same flow already recommended by the [`POST /price`](/references/api/get-price) and [`POST /execute`](/references/api/execute) references. See [Step Execution](/references/api/api_core_concepts/step-execution) for how to submit each step returned by the quote.
 
+## 2026-09-03 — Quote requests with a `referrer` require an API key
+
+**Breaking** — `POST /quote` and `POST /quote/v2`: requests that include a `referrer` in the body now require a valid `x-api-key` header. Requests with a referrer but no valid key return `401` with `errorCode: "UNAUTHORIZED_QUOTE"`. Note that the Relay SDK sets `referrer` automatically, so SDK integrations must configure **`apiKey`** on `createClient` or pass the key per call via the `headers` parameter. Create and manage API keys in the [Relay Dashboard](https://dashboard.relay.link) — see [API keys and Rate Limits](/references/api/api-keys).
+
 ## 2026-09-01 — Request signature endpoints removed
 
 **Breaking** — `GET /requests/:requestId/signature` and `GET /requests/:requestId/signature/v2` have been removed. Calls to both endpoints now return `404`. Both returned a solver signature over a small subset of intent fields, which never covered the minimum output amount, required a second call after the quote, returned only partial data until the request reached a terminal state, and behaved inconsistently across chains.