Authentication
Authenticate every request with an API key.
Send your API key as a bearer token on every request:
Authorization: Bearer rvt_...Manage keys
Create, disable, roll and delete keys at app.revecto.dev/keys.
| Action | Effect |
|---|---|
| Create | The key is shown once. An expiry date is optional; without one the key never expires. |
| Disable | The key stops authenticating at once. Enable it again to bring it back. |
| Roll | The key gets a new secret, shown once; the old secret stops working immediately. An expired or disabled key cannot be rolled. |
| Delete | The key is removed. |
The number of keys depends on your plan; see Plans and limits.
Rate and concurrency limits apply per project, not per key: every key of a project shares them.
Keep keys server-side
Call the API from your server, and read the key from the environment or a secret store. Never ship a key in browser or mobile code.
401 responses
A missing or unknown, disabled or expired key is refused with 401 invalid_api_key, api_key_disabled or api_key_expired; see Error codes.
Regions
Each project has a region, chosen when you create it and fixed after. Call the host of your project's region with the project's keys:
| Region | Host |
|---|---|
eu | https://api.eu.revecto.dev |
us | https://api.us.revecto.dev |
apac | https://api.apac.revecto.dev |
Choose the region closest to the servers that call the API. apac is best effort: Asia-Pacific is not guaranteed. Templates, their assets and usage records are stored in the European Union whatever the region. A project cannot move to another region.
A key used on another region's host is refused before any conversion, and the response names the host to call:
{
"code": "wrong_region",
"error": "this key belongs to a project in region us; use api.us.revecto.dev",
"region": "us",
"host": "api.us.revecto.dev"
}See Error codes for wrong_region and not_found.