diff --git a/harnesses/token-trade-coverage/.gitignore b/harnesses/token-trade-coverage/.gitignore
index 7de85174..a0113a2f 100644
--- a/harnesses/token-trade-coverage/.gitignore
+++ b/harnesses/token-trade-coverage/.gitignore
@@ -1,4 +1,2 @@
 .env
-scanner
 /scanner
-cmd/scanner/scanner
diff --git a/harnesses/token-trade-coverage/cmd/scanner/bitquery.go b/harnesses/token-trade-coverage/cmd/scanner/bitquery.go
index c20ad8e2..babbbca1 100644
--- a/harnesses/token-trade-coverage/cmd/scanner/bitquery.go
+++ b/harnesses/token-trade-coverage/cmd/scanner/bitquery.go
@@ -84,7 +84,12 @@ func fetchBitquery(
 	if err != nil {
 		return 0, 0, err
 	}
-	req.Header.Set("X-API-KEY", apiKey)
+	// Bitquery's new OAuth-style keys (ory_at_*) require Bearer auth on
+	// streaming.bitquery.io/graphql. The legacy X-API-KEY header on that
+	// endpoint returns HTTP 402 "No active billing period" even when the
+	// account has an active free plan — the migration was silent and the
+	// docs still show the old header on some pages.
+	req.Header.Set("Authorization", "Bearer "+apiKey)
 	req.Header.Set("Content-Type", "application/json")
 
 	resp, err := client.Do(req)