Authentication

The Rindee API authenticates every request with a Bearer API key.

Authorization: Bearer rk_live_...

Requests without a valid key receive 401 Unauthorized.

API keys

Keys look like rk_live_ followed by a random token. The full key is returned only once, when the key is created — store it securely (e.g. a secrets manager). Afterward only the prefix (the first 12 characters, e.g. rk_live_ab12) is shown, so you can identify a key without exposing it.

Treat keys like passwords: never commit them to source control, embed them in client-side code, or share them in URLs.

Capabilities

Each key is scoped to a set of capabilities that gate what it can do:

Capability	Grants
operate	Day-to-day writes: calls, contacts, campaigns, agents, scheduling.
settings	Organization settings writes.
api_keys	Create and revoke API keys.
webhooks	Manage webhook endpoints.

Read access is included; capabilities gate writes. A key can never exceed the capabilities of the member that created it — requesting more silently grants only the intersection.

Managing keys via the API

If a key has the api_keys capability, it can manage other keys.

# Create a key (the raw key is in the response — store it now)
curl -X POST https://api.rindee.dev/v1/api-keys \
  -H "Authorization: Bearer rk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "label": "CI pipeline", "permissions": ["operate"] }'

# List keys (prefixes only, never the raw key)
curl https://api.rindee.dev/v1/api-keys \
  -H "Authorization: Bearer rk_live_your_key_here"

# Revoke a key
curl -X DELETE https://api.rindee.dev/v1/api-keys/{key_id} \
  -H "Authorization: Bearer rk_live_your_key_here"

Key creation is rate-limited to 5 requests per hour per organization. See Rate limits.

Rotating a key

To rotate: create a new key, deploy it, confirm traffic has moved over, then revoke the old one. Revocation takes effect immediately.