Skip to main content

API keys

API keys authenticate your scripts and tools to the API. A key acts as the user who created it: it has the same permissions as that user.

Creating a key​

  1. Open your Profile, from the menu under your avatar at the top right.
  2. In the API Keys section, enter a name and a key expiration date.
  3. Click Create key.
  4. Copy the key and store it safely, for instance in a password manager or your tool's secret store. It will not be shown again.

Using a key​

Pass the key in the x-api-key header of every request:

curl -H "x-api-key: $RK_API_KEY" https://<your-red-kite-url>/api/

Deleting a key​

In the API Keys section of your profile, open the key's menu and click Delete. Requests using the key are refused right away. Delete a key as soon as it is no longer used, or if it may have leaked.

Good practices​

  • One key per integration, with a name that says where it is used, so that you can revoke one without breaking the others.
  • Short expiration dates, renewed when needed.
  • A dedicated user for each integration, member of a group with only the permissions the integration needs. Since a key has the permissions of its user, this limits what a leaked key could do. See Managing roles and permissions.