RIXL authenticates API requests with project-scoped keys sent in the X-API-Key header.

Create an API Key

Authenticate Requests

Use the API base URL https://api.rixl.com and include X-API-Key on each request.

curl -X GET "https://api.rixl.com/projects" \
  -H "X-API-Key: YOUR_PROJECT_API_KEY"

const response = await fetch("https://api.rixl.com/projects", {
  headers: {
    "X-API-Key": process.env.RIXL_API_KEY,
  },
});

Verify Setup

Send a read request with your key:

curl -X GET "https://api.rixl.com/projects" \
  -H "X-API-Key: YOUR_PROJECT_API_KEY"

• 200 means authentication works.
• 401 usually means missing, malformed, revoked, or expired key.
• 403 usually means project/key scope mismatch.

Rotate and Revoke Keys

1. Create a replacement key.
2. Deploy the new key to all services.
3. Confirm traffic uses the new key.
4. Revoke the old key.

Revoke compromised or unused keys immediately.

Security Checklist

• Use separate keys per environment (dev, staging, prod).
• Use separate keys per service to improve auditability and blast-radius control.
• Use descriptive key names for service ownership and audits.
• Keep keys in secret managers, not source code.
• Monitor and alert on repeated 401/403 errors.

Related

• Rate Limits
• Error Handling
• API Reference