Skip to main content

​
Create a key

An owner of your organization creates keys in the dashboard under Settings → API & AI assistants:
  1. Name the key after what will use it, e.g. Data warehouse sync.
  2. Choose when it expires: 30, 90 or 180 days, or one year. Every key expires.
  3. Choose its access:
    • Read only — every read endpoint.
    • Read and manage prompts — also create, edit and switch prompts on or off.
  4. Click Create key and copy it. It looks like rr_api_….
The key is shown once. RankRaft keeps only a fingerprint of it, so it cannot be shown again. If you lose it, revoke it and create another.
Every member of the organization can see the list of keys — their names, who created them, when they expire and when they were last used — but never the keys themselves. Only owners create and revoke.

​
Send the key

Put it in the X-API-Key header:
Authorization: Bearer rr_api_… works too.
Never put a key in a URL. A request with a key in its query string is refused with 400 api_key_in_url — by then the key may already be in proxy and browser logs, so revoke it. Never use a key in browser code: the API sends no CORS headers, on purpose.

​
What a key can reach

A key belongs to your organization and reads every site in it. It cannot reach another organization’s data: a site id from another account answers 404, exactly as if it did not exist.

​
When a key stops working

API keys work with the REST API only. AI assistants connect to the MCP server by signing in instead. | A read-only key calls a write endpoint | 403 insufficient_permission | Revoking a key in the dashboard takes effect on the very next request. A downgrade or a lapsed payment cuts API access at once, not when the key expires.

​
Check a key

GET /v1/me returns the key’s name, access, expiry and organization — a good connection test.