Authentication

Authentication is a single header. Both forms below are accepted:

X-API-Key: rv_live_a1b2c3d4e5f6_SECRETPART
Authorization: Api-Key rv_live_a1b2c3d4e5f6_SECRETPART

Key format

A key looks like rv_<environment>_<prefix>_<secret>. The environment is test or live. The prefix identifies the key; the secret half is never stored on our side, only a SHA-256 digest of it.

We cannot recover a lost key

The raw key is displayed exactly once, at the moment it is issued. If it is lost, we revoke it and issue a new one. This is deliberate — a key we could email back to you is a key an attacker could also retrieve.

Scopes

Each key holds a set of scopes such as kundli, matching or vastu. Calling an endpoint outside your scopes returns 403 scope_denied. Ask for the narrowest set that does the job — if a key leaks, its scopes are the blast radius.

Rotation

Ask us for a second key, deploy it, confirm traffic has moved, then have the first revoked. Both work simultaneously, so rotation needs no downtime. Rotate whenever someone with access to the key leaves your team.

Keep keys server-side

Never ship a key in a mobile app, a browser bundle or a public repository. Anything shipped to a device is readable by whoever holds the device. Proxy calls through your own backend.