Authentication

Sending your key

Send it as a bearer token, or as an X-API-Key header — both are accepted:

curl https://api.rascador.store/v1/me -H "Authorization: Bearer $RASCADOR_API_KEY"

curl https://api.rascador.store/v1/me -H "X-API-Key: $RASCADOR_API_KEY"

If you send both headers, Authorization wins. A malformed Authorization header (not Bearer <token>) is rejected outright rather than falling back to X-API-Key.

Key format

Keys look like rsc_live_<prefix>_<secret> or rsc_test_<prefix>_<secret>. The environment is baked into the key itself — see Environments for what that changes.

Failure responses

Missing credentials and invalid/expired/revoked keys both return 401:

{
  "error": {
    "code": "missing_credentials",
    "message": "No API key was provided.",
    "retryable": false
  }
}

A key that's valid but lacks the scope required for an endpoint returns 403 insufficient_scope, with the required and granted scopes in error.details.

Rotating and revoking

Keys are created, rotated and revoked from API Keys — never through the API itself. Revocation takes effect within about 30 seconds everywhere.