Authentication
Every request carries your API key in the Authorization header.
Authorization: Bearer rb_live_xxxxxxxxxxxxxxxxxxxxxxxxKeys
Create and revoke keys in your account, under API. A key starts with rb_live_ and is shown once, when you create it. An account can hold up to five active keys; they all draw on the same request quota.
Good practice
Send requests from your servers only; never ship a key in a web page or an app. Store it in an environment variable or a secret manager, and if you suspect it leaked, revoke it in your account and create a new one: a revoked key stops working at once.
Errors
A missing key returns
401 unauthenticated; an unknown or revoked key returns 401 invalid_key; an account without a paid plan or trial returns 403 plan_required.