Authentication

RapidRoot will authenticate machine-to-machine requests with a workspace-scoped API key presented as a bearer token over HTTPS. There is no separate session, login handshake or signature scheme for standard API calls.

Authorization: Bearer <API_KEY>

• Keys are issued per workspace and per environment, so test traffic never shares a credential with production.
• Keys are shown once at creation and stored only as a hash on our side.
• Multiple active keys are supported so you can rotate without downtime.
• Keys can be revoked immediately from the dashboard.

• Create — generate a key in the dashboard and store it in your secret manager.
• Use — send it as a bearer token on every request from your server.
• Rotate — create a second key, deploy it, then revoke the first.
• Revoke — revocation takes effect immediately for new requests.

API keys do not expire automatically today. Scheduled expiry is a planned option rather than current behaviour.

• Store keys in a secret manager or environment variable — never in source control.
• Call the API from your backend, never directly from a browser or mobile client.
• Use separate keys per environment and per integration so a single leak has a small blast radius.
• Rotate on staff changes and on any suspected exposure.
• Validate and sanitise every input before forwarding it to the platform.
• Log request identifiers, not credentials or full message payloads.