Authentication

The RevKeen API uses API keys to authenticate requests. Include your API key in the x-revkeen-key header (or Authorization: Bearer header) of every request.

RevKeen uses Unkey under the hood to issue, manage, and rate-limit these keys.

Making Authenticated Requests

All requests to the RevKeen API must include an API key:

x-revkeen-key: rk_live_your_api_key

If the header is missing or invalid, the API responds with:

• 401 Unauthorized
• An authentication_error body as defined in the Error schema

Example with cURL

curl https://api.revkeen.com/v2/customers \
  -H "x-revkeen-key: rk_live_123..." \
  -H "Content-Type: application/json"

Example with the TypeScript SDK

import RevKeen from '@revkeen/sdk';

const client = new RevKeen({
  apiKey: process.env.REVKEEN_API_KEY,
});

const customers = await client.customers.list();

Example with the Python SDK

from revkeen import RevKeen
import os

client = RevKeen(api_key=os.environ["REVKEEN_API_KEY"])
customers = client.customers.list()

API Key Formats

API keys are generated from the RevKeen Dashboard > Developers > API Keys page.

Each key has:

• A prefix indicating the environment
• A random secret (the sensitive part)
• Associated metadata (tenant, rate plan, roles) managed by Unkey

API Key Scopes

API keys can be restricted to specific scopes for enhanced security. This allows you to create limited-access keys for different services.

Security Best Practices

• Use environment variables -- Store API keys in environment variables, not in code
• Rotate keys regularly -- Create new keys periodically and revoke old ones
• Use minimal scopes -- Only request the permissions your integration needs
• Monitor API usage -- Review API logs in your dashboard for suspicious activity
• Never commit keys to version control -- Use .gitignore to exclude .env files
• Never expose keys in client-side code -- API keys should only be used server-side

Rate Limiting

The API enforces rate limits to ensure fair usage. Rate limiting is enforced per API key via Unkey.

Each response includes rate limit headers:

• X-RateLimit-Limit -- Maximum requests allowed
• X-RateLimit-Remaining -- Requests remaining in the current window
• X-RateLimit-Reset -- Unix timestamp when the limit resets

When a limit is exceeded, the API returns 429 Too Many Requests with a rate_limit_error body.

Next Steps