Authentication
Send your API key, and choose the right kind of key.
Every request carries an API key in the X-API-KEY header:
X-API-KEY: rzlb_live_sk_...A missing, unknown, revoked or expired key gets 401.
Kinds of key
You choose a key's kind when you create it. Its prefix shows the kind and the environment: rzlb_live_<sk|pk>_….
| Kind | Prefix | Use it from | What it can do |
|---|---|---|---|
| Secret | sk | Your servers only | Everything its families allow |
| Publishable | pk | A browser or mobile app | Only read (GET and HEAD). Anything else gets 403. |
| Environment | Prefix | Where requests go |
|---|---|---|
| Live | rzlb_live_ | The real service |
| Test | rzlb_test_ | The sandbox. Not offered yet: every key you create today is live. |
So rzlb_live_sk_… is a live secret key. Calls made with a live key are paid for in credits.
Families
A key can call every family, unless you limit it to some of them when you create it (Limit to specific families in the Create key dialog). Anything outside the plan, or outside the key's own list, gets 403. An application can hold up to 10 active keys, and your plan may allow fewer in all. Creating one more than that gets 409. Use separate keys for separate integrations.
Limiting where a key works
When you create a key you can also set:
- Allowed IPs: up to 20 addresses or ranges (such as
203.0.113.0/24). Requests from anywhere else get403. - Allowed websites: up to 20 origins (such as
https://shop.example.com). A browser calling from any other website gets403. Use this for publishable keys, so a key copied from your page's source doesn't work on someone else's site.
Expiry and revoking
A key expires after 10, 30 or 90 days, or never, as chosen when it was created. Revoke stops a key at once and can't be undone. To replace a key, create a new one, move your integration over to it, then revoke the old one.
Keep secret keys secret
Never put a secret key in client-side code or commit it to source control. Load it from an environment variable or a secrets manager. In a browser or app, use a publishable key.