Authentication

All requests are authenticated with a personal API key.

Create and manage keys on the API keys page. A key looks like rb_live_… and is shown in full only once at creation — store it somewhere safe. Only a hash is kept on our side.

Authorization header

Send the key as a bearer token on every request:

Authorization: Bearer rb_live_your_key

Scope

• A key acts as you — it can send for any organization you own.
• Every call counts against, and is capped by, your plan's quota.
• Revoking a key takes effect immediately.

Auth errors

• 401 Unauthorized — missing, malformed, or revoked key.
• 429 Rate limited — too many requests; see Limits.