Skip to main content
Send credentials in the standard bearer header:

​
API keys

API keys are created for a user or service account and are bound to a RevoEngine instance. They are recommended for server-to-server integrations.
The server resolves the instance from the key. Clients should not send a different tenant selector. If an instance header is supplied, it must identify the same instance or the request is rejected.

​
Platform sessions

The browser platform uses a short-lived authenticated session. Instance-scoped API requests made with this session include the instance selected by the user. Session security state can invalidate previously issued access when account or device posture changes.

​
Credential rules

  • Keep API keys in a server-side secret manager or environment variable.
  • Never embed a key in browser JavaScript, source control, logs, screenshots, or Assistant messages.
  • Prefer service accounts for machine integrations.
  • Assign only the roles required by the operations the integration calls.
  • Rotate or revoke a key when its storage boundary or operator changes.
Query-string token transport exists only for limited compatibility cases and can leak through history, logs, and proxies. Use the Authorization header for all new integrations.

​
Authorization failures

  • 401 means the credential, required instance context, or session security state is missing or invalid.
  • 403 means the identity is valid but lacks the required role or resource access.
Authentication does not grant access to every resource. Instance isolation, role checks, ownership, and resource-specific access are enforced after the credential is validated.
Last modified on September 5, 2026